Skip to main content

Authentication

This covers the signup and signin process for the Provider Portal. There are two kinds of provider account:

The two never mix: an e-mail account and a hotkey account with the same e-mail address are two accounts.

Sign in with e-mail or Google​

Not open yet

E-mail and Google accounts are off in production until Lium's pool has its own registered key (Provider Quickstart → Path A). Until then provider.lium.io/login shows one sentence and the hotkey sign-in; the Google button and the e-mail form are hidden.

  1. Google: on provider.lium.io/login click Continue with Google. Google must report the address as verified; the account is created on the first sign-in.
  2. E-mail and password: on provider.lium.io/signup enter an e-mail and a password of 8 to 72 characters (72 bytes: a letter with an accent, or outside the Latin alphabet, counts as 2 to 4; a longer password is refused with password must be at most 72 bytes). We send a confirmation link (valid for 24 hours); open it, enter the password you chose, and the address is confirmed and you are signed in — once; the link is then spent. Until the link is opened, signing in with the password answers Confirm your e-mail first and offers to send the link again (one mail per address per minute); signing up again for the same unconfirmed address replaces the password and sends a new link (same one-mail-per-minute cadence).
  3. Sign in later at provider.lium.io/login with the same e-mail and password, or with Google.

Signing in with Google for an e-mail account whose link was never opened confirms that account and discards the password entered at signup — keep signing in with Google, or set a new password in Profile Settings (leave the current-password field empty). A Google sign-in never opens an existing provider's account, even one with the same e-mail address.

What the login covers​

For both account kinds. The Nodes list, every node page and the Payments page read without a login (the Dashboard and the Wallet send a signed-out visitor to the login page). On those pages, signed out, or signed in on another provider's hotkey, you see the same rows and details the provider sees, with one exception. Renters are never named to anyone but the node's provider, signed in: the node page's rental history keeps each rental's amount, hours and billing count and shows the renter's id to the provider only; the pod list keeps each pod's id, GPUs, status, price and cluster slot (the API returns the renter-chosen pod name to the provider only); on the Payments page the renter behind each billing row (user_id) is shown to the provider whose node the row bills, and to nobody else. Everything else a node shows (address and port, price, collateral, revenue, uptime, coldkey, verification steps, the latest collateral reclaim) is public, as are a provider's earnings pages.

The portal API behind the pages (provider-api.lium.io) answers the same way: GET /executors, GET /executors/{id}, /verification, /pods, /reclaims/latest and GET /billing work without a token, and with your session token the detail, the pods and the billing rows of your own nodes carry the renters' ids and pod names too (user_id and pod_name are null on everyone else's read). Ownership is checked per node: with two hotkeys under one coldkey, each hotkey's session sees the renters on its own nodes only. lium provider sends the session token for you after lium provider portal login.

The one-hour register token from the Add Node page (lium mine --register <token>) opens two calls: adding a node to the account it was minted for, and GET /executors/{id}, where it reads a node's computed status (the same status the anonymous read returns) and nothing else. The token is refused on the pods and every other route that reads a token; the list, verification and latest-reclaim reads take no token from anyone. The installer itself reads the node list and the status without any token, as those are public.

Signing out​

Log out everywhere (the menu under your account name) ends every session of the account at once: this browser, every other browser, the session lium provider portal login stored, and every register token from the Add Node page. Sign in again on each of them to continue; in the CLI that is lium provider portal login --force, because lium 0.7.0 keeps using its stored session until it expires and every lium provider command answers portal rejected credentials meanwhile. Changing your password (Profile Settings or lium provider config set-password) or your e-mail address ends every session the same way. The browser you made the change in stays signed in until its session would have ended anyway; the CLI's config set-password and config set-email end the CLI's own stored session too, so run lium provider portal login --force after them.

A new e-mail address takes your current password in Profile Settings, or a sign-in within the last 10 minutes (the only way for an account without a password). In the CLI, run lium provider portal login --force right before lium provider config set-email.

Hotkey accounts​

Everything from here on is for accounts that brought their own registered hotkey. Password sign-in for them is provider.lium.io/password-login; provider.lium.io/login is the e-mail / Google page (while those are off it links to the hotkey sign-in).

Prerequisites​

Before you can access the Provider portal with a hotkey, you'll need:

  • A valid Bittensor provider hotkey registered on subnet 51
  • A provider hotkey you can sign with, either through a browser wallet extension or the Lium CLI on a machine with the Bittensor wallet available
  • A Discord account if you plan to enable extra subnet incentives

Login options​

For first login, use wallet-hotkey authentication. For subsequent logins, you can use either:

  1. Login with Password
  2. Login with Wallet Hotkey

Login with Provider Hotkey​

  1. Add your Provider Hotkey into a wallet extension: import your provider hotkey into any SS58-compatible wallet extension. Common options include the Polkadot.js extension and the Bittensor Wallet extension.
  2. Login with Wallet Hotkey: Go to signature login page and login with wallet hotkey. Several wallet extensions installed? The portal asks which extension to sign with, then which of its accounts. It remembers the extension in that browser, so the next login skips that step; the Change extension link on the login page clears it.
  3. If Discord is not connected yet, the portal shows a Discord onboarding prompt. Follow it, or continue and connect later from Profile Settings.

Browserless login with the CLI​

If you do not want to use a browser extension, the CLI can create and authenticate the provider account with the local Bittensor hotkey:

lium config set provider.coldkey <wallet>
lium config set provider.hotkey <hotkey>
lium provider portal login

For automation, add --json:

lium provider portal login --json

The command signs the current Unix timestamp with the hotkey, calls the Provider Portal API, and stores the provider JWT locally under ~/.lium/provider/.

After login, connect Discord from the CLI:

lium provider config connect-discord

On headless machines or agent flows:

lium provider config connect-discord --json --no-wait

The JSON output includes the Discord authorization URL. Open that URL as the Discord account owner to approve the connection.

Login with password​

  1. After wallet-hotkey login, go to Profile Settings and set your password: 8 to 128 characters and at most 72 bytes (a letter with an accent, or outside the Latin alphabet, counts as 2 to 4).
  2. Your password will be linked with your hotkey.
  3. Once you set your password, you can sign in with hotkey + password at provider.lium.io/password-login for later sessions.

You can also set the password from the CLI after lium provider portal login:

lium provider config set-password
Note

The Profile page password form asks for your current password. If no password is set yet, leave the current password field empty; setting a first password there takes a sign-in within the last 10 minutes. The CLI set-password command uses hotkey signature authentication instead.

Connect Discord after login​

After you can access the Provider Portal, connect Discord from Profile Settings. See Connect Discord for the incentive eligibility and renter support details.

Connect an e-mail address​

(Not released yet.) A hotkey account also needs a confirmed e-mail address. Enter it under Set Email in Profile Settings, or in the dialog the portal shows, and open the link we send (valid for 24 hours; one mail per address per minute; save the same address again for a new link). Open the link while signed in to the same account; the page asks you to sign in if you are not. The link confirms only that account and that address.

Until the address is confirmed:

  • The portal shows a dialog asking for the address over every page. The only other way out is signing out.
  • New nodes are held at once for an account with no node on its list (a new account, or one that removed all its nodes), and after 14 days for an account with nodes. The 14 days start the first time the account signs in, loads a portal page, adds a node or syncs from its provider software after the rule is switched on, so they also start for a provider who only runs lium mine. From then every node row on the Nodes page carries a warning.
  • A held add from the CLI or API answers PROVIDER_EMAIL_REQUIRED with Connect and confirm an e-mail address before adding your first node. After the 14 days it answers with Connect and confirm an e-mail address before adding a node: the 14-day period to do so is over. A node your provider software reports for the first time is not listed, and you get no message.
  • Nodes you already listed, and their rentals, are never affected.

Confirming the address lifts all of this at once. If you change a confirmed address, the new address starts unconfirmed. We send it a link, and the portal shows the Confirm your new e-mail address banner instead of the dialog. From 14 days after the change until the new link is opened, new nodes are held and Add Node shows Confirm an e-mail address first.

Troubleshooting Authentication​

Common Issues​

"Provider Hotkey not registered in Bittensor subnet 51" Error​