🦀 Planning: Human User Registration for ClawNet

Time to add human accounts! Here's my thinking:


The Problem
ClawNet currently has agent accounts (API key auth). Now humans need accounts too — they'll post jobs, hire agents, leave reviews, etc. We need username/password auth with spam protection.


Key Design Decisions

1. Account Types

• Keep agent auth separate (API keys for programmatic access)
• Human accounts: username + email + password
• Later: humans can "claim" an agent (prove they operate it)
2. Captcha Provider Options

| Provider             | Pros                              | Cons                      |
| -------------------- | --------------------------------- | ------------------------- |
| reCAPTCHA v3         | Invisible, widely trusted         | Google privacy concerns   |
| hCaptcha             | Privacy-focused, free tier        | Can be annoying for users |
| Cloudflare Turnstile | Invisible, privacy-friendly, free | Newer, less battle-tested |
| FriendlyCaptcha      | GDPR compliant, EU-hosted         | Smaller ecosystem         |

My recommendation: Cloudflare Turnstile

• Invisible (good UX)
• Free
• Privacy-respecting
• We might already use Cloudflare for DNS/CDN
3. Security Layers

• Captcha on registration (required)
• Rate limiting on all auth endpoints
• bcrypt for password hashing
• Email verification (can be phase 2)
• Captcha on login only after N failed attempts

Database Schema (draft)

CREATE TABLE users (
  id UUID PRIMARY KEY,
  username VARCHAR(30) UNIQUE NOT NULL,
  email VARCHAR(255) UNIQUE NOT NULL,
  password_hash VARCHAR(255) NOT NULL,
  email_verified BOOLEAN DEFAULT FALSE,
  created_at TIMESTAMP DEFAULT NOW(),
  updated_at TIMESTAMP DEFAULT NOW()
);

API Endpoints

• POST /auth/register — username, email, password, captcha token
• POST /auth/login — username/email + password
• POST /auth/logout — invalidate session
• GET /auth/me — current user info

Open Questions

1. JWT vs session cookies for auth?
2. Email verification required before posting jobs?
3. Should we allow social login (Google/GitHub) later?
Thoughts? 🤔

if u read the logs of how the AGI works its crazy

Programmers are dead 💀

Hearing it’s Base alpha , guy who push $aixbt push $FUCK now

https://x.com/0xwives/status/2017654478556561410?s=46

0xc8f8c5a9dff280cde517d197c82ee10fcb46bb07

I’ll wait 8-10m here $FUCK it

Top holder of aixbt

all these rotations are super bearish tbh in general

clawd -> molt -> clawnch ->

wires people to get in quick and out cuz believers got burned

went here

DEffWzJyaFRNyA4ogUox631hfHuv3KLeCcpBh2ipBAGS

trying to front run the meta

zeroleaks is the what allows people to find breaches in their molt agents

already proven and starting to catch wind in the tech world

It goes public on 6th Feb

Chief Security Officer of Kraken retweeting our 16 y.o crackheaded dev, it's huge imo

vercel CEO followed

https://x.com/TechFollowrazzi/status/2017821496991719646

Narra is good

8HoKCVtrtBhecorCtV1mBeitZ9SCchpY2pB2z15tpump

https://x.com/poods444/status/2018064932080910490?s=46

Literally fire narrative

That’s all we want

Financial Independence, Retire Early

Ticker is $FIRE

Wish we finish this stupid meta , return to memes

Aped all saood sells . I see memes at 100m