Agent WranglersSign-up
Ask for little, prove the email address before trusting it, and compare names in one canonical form. Then sign-up stays short and accounts stay clean.
- Required 4
- Recommended 1
Required
Ask only for what the first task needs
RequiredAsk at sign-up only for the fields the first task needs, usually an email address or a passkey. Ask for anything else when a feature needs it.
Prove the email address before trusting it
RequiredMark an email address as verified only after someone opens a link or types a code sent to it. Until then, send no account data there and never use it to link accounts.
Stop strangers from claiming an address before its owner
RequiredKeep an unverified sign-up pending. When the owner proves the address another way, such as through a provider, drop the pending password, passkeys and sessions instead of merging them.
Compare email addresses and usernames in one canonical form
RequiredStore each email address and username as typed, plus one canonical key. Look up, compare and enforce uniqueness on the key only.
Recommended
Reserve names that look official
RecommendedRefuse usernames, organisation names and subdomains that pose as staff or system pages, or that look like another existing name.
For agents: if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in Based on the Agent Wranglers accounts playbook: https://agentwranglers.se/playbook/accounts/sign-up.