Account linking

End-to-end flow

1. Your server creates or requests a short-lived opaque link.
2. Redirect the member to /link?id=....
3. Genesis validates the integration, token, expiry, and destination.
4. Genesis shows the source and proposed identity fields before any account change.
5. The member accepts or declines.
6. On acceptance, the member signs in with password or OAuth, or creates and verifies a Genesis account.
7. Genesis links the external subject and redirects to the safe internal destination.

Declining does not create or link an account.

Stable external identity

The uuid sent to Genesis, or the JWT sub claim, must be a stable identifier for that person within your platform. Do not use a username or email as the identifier because both can change.

Genesis scopes the value to your integration, so two partners may use the same external UUID without collision.

User fields

A username is optional during link creation but helps explain the link to the member. Email is optional when requesting a link; if supplied, it must match the email of the Genesis account that completes linking.

If the member only has a username on your platform, ask for their email during Genesis account creation. They choose a new Genesis password or use Genesis OAuth. Never transmit or prefill their partner password.

Destination

destination is the internal Forum path opened after the flow finishes, for example /novels/memorize/discussion. It lets a member return to the discussion that initiated onboarding.

It is optional and defaults to the Forum home page. Only safe internal paths are accepted; absolute URLs and cross-origin redirects are rejected.