Hardened by default
Row Level Security on every table, privileged columns locked at the database layer, and audited authentication events.
Production-grade authentication
One secure account for the entire XBX extension.
Secure authentication infrastructure for the XBX Chrome Extension. Sign up once, verify your email, and every premium feature unlocks through a session your browser can trust.
No card required. Email verification is mandatory for every account.
Security is the product
XBX Authentication is built so a compromised client can never escalate its own access.
Verified email sign-up
Accounts must confirm ownership of their address before a session is issued. Resend is rate limited and never leaks existence.
Silent session renewal
Access tokens refresh in the background; expiry triggers an immediate, clean sign-out on every surface.
Server-side entitlements
The extension never trusts local state. Premium unlocks are validated against the backend on every session check.
Abuse resistant
Per-IP and per-account rate limiting on login, reset and verification, with generic error messages throughout.
Extension-ready API
A versioned HTTP surface at /api/public/v1 with CORS tuned for chrome-extension:// callers and bearer-only auth.
How it works
- 01
Create your account
Sign up with your email and a strong password.
- 02
Verify your email
Confirm the link we send so your account can issue sessions.
- 03
Sign in to the extension
Use the same credentials inside XBX — entitlements sync instantly.
Ready to unlock XBX?
Creating an account takes under a minute and works across every device you sign in on.