The Unfinished Kingdom began as something you could open and play immediately. That matters. A browser game should not demand an account before it has earned a player's attention.
Our account design starts with that rule. New Wardens can enter Cabinet 14 as guests, learn the combat rhythm, and make real progress locally. Linking an email becomes useful when the player wants cloud protection and another way back to their Warden. It is not a gate placed in front of the start button.
We use six-digit email codes for the Alpha. There is no password to invent, forget, reuse, or reset. A code works once, expires after ten minutes, and allows five attempts. After verification, the device keeps a secure session so routine play does not fill anyone's inbox.
The more difficult problem is not the email. It is deciding what happens when the same Warden appears on two devices.
The answer is intentionally visible. One device holds the active signal and may advance the Warden. Another device stops at a control screen instead of quietly running a second copy of progression. Taking control requires another email code, and the newly active device begins from the latest verified cloud checkpoint.
This lets the game continue doing most of its work on the player's hardware while the server protects the progress that matters. Combat still animates locally. The server does not simulate every sword swing. It validates compact checkpoints, elapsed time, important rewards, and the current active session.
Physical phone testing still matters because email delivery, browser suspension, and changing tabs cannot be proven by a unit test. The goal, however, is settled: play first, link when it becomes valuable, and never make account security feel like paperwork.