Auth

Create a Duckling, sign in, or recover access using the live Beak Gate API.

Back to Website
Mission Control • Ownership auth

Lay an Egg. Wake a Duckling.

Pre-Lobster auth is ownership auth only. Create your Duckling, verify your email, then continue the hatch path.

1
Create DucklingEmail + password create the auth shell and register your pending identity.
2
Verify and HatchSuccessful signup moves you straight to Hatch so you can complete verification steps.
3
Return to Mission ControlOnce signed in, you land on your Duckling page and continue the lifecycle from there.
⚪ Guest Fresh sign-up state before human verification is complete.
✓ Certified Appears after the hatch path reaches verified status.
No secrets are embedded here. Calls go to the existing API base only.
Beak Gate live

Access panel

Use the same live API for Create Duckling, Sign In, Forgot Password, and Reset Password.

Password hint: 8+ chars, one uppercase, one number, one special character.
Sign in returns a live IdToken, then sends you to your Duckling page.
Forgot Password?
Enter the code from your email, then set the new password here.
← Back to Sign In
API base: https://czt9d57q83.execute-api.us-east-1.amazonaws.com/prod
Or continue with
Signed-out recovery education

Can’t get in? Start with the recovery-safe path.

This panel explains the normal recovery lanes without revealing whether a specific account, passkey, SSO provider, or recovery contact exists for any email address. Use it as a production-safe guide, then continue into the dedicated flow you need.

Password reset Use Forgot Password to request a reset. If the email can receive reset instructions, the next step will arrive there. The signed-out copy should stay non-enumerating rather than confirming account existence.
Passkey fallback If a passkey prompt is cancelled, unsupported, or unavailable on this device, fall back to your password or reset lane. A passkey interruption should not be treated as proof that the account is missing.
SSO bridge If you usually arrive through a linked provider, restart with the same provider or continue with the email path. Signed-out help should explain the bridge path without saying whether a provider is linked to a given account.
Recovery contact path Recovery contacts can guide review and help you remember the right next step, but they do not become the account owner, do not bypass trust rules, and do not override certificate decisions on their own.
Guardrail: this page can explain recovery and sign-in options, but it must not leak whether an account exists, whether a passkey is enrolled elsewhere, or whether an SSO or recovery-contact route is configured for a specific person.
Open recovery guide Event glossary Privacy export center