Logging in to a Bitcoin site with your Lightning wallet means scanning a QR code with the wallet app you already use, tapping "Log in" in the wallet, and watching the browser sign you in a second later. No email, no password, no username. The protocol behind it is called LNURL-auth, and on Lightning Faucet it is the fastest way to create an account: your first scan makes the account, and every scan after that logs you back into the same one.
This guide walks through exactly what happens on our side when you scan our login QR, which wallets handle it, and the handful of things that trip people up (switching wallets, expired codes, linking a wallet to an email account). We run the server that verifies these signatures every day, so the details below come from how our login flow actually behaves, not from the spec alone. If you want to try it while you read, open the Lightning wallet login page and keep your wallet app handy.
What LNURL-auth is, in one paragraph
The short definition
LNURL-auth is a login standard for Lightning wallets. The website shows a QR code containing a one-time challenge. Your wallet signs that challenge with a private key it keeps for that website only, and sends the signature back. The website checks the signature, and if it is valid, you are in. The key that identifies you is called a linking key. It never leaves your wallet in private form; the site only ever sees the public half.
Why it replaces a password instead of adding to it
A password is a secret you share with the site, which means the site has to store something derived from it and you have to remember it. With LNURL-auth there is no shared secret at all. Lightning Faucet stores your public linking key and nothing else about the login. If someone copied our user table, they would have a list of public keys that cannot sign anything. There is no password to reuse across sites, nothing to phish out of you on a fake login form, and nothing to reset.
How to log in to Lightning Faucet with your Lightning wallet
Step 1: open the login QR
Go to the wallet login page and choose the Lightning wallet option. The page generates a fresh challenge for you and shows it as a QR code. Behind that QR is an LNURL, which is just a bech32 encoded web address pointing at our callback with a random 32 byte value attached. That value is the challenge, called k1 in the spec.
Step 2: scan it with your wallet
Open your Lightning wallet and use its normal scan button, the same one you would use to pay an invoice. A wallet that supports LNURL-auth recognizes the code as a login request rather than a payment and shows a prompt along the lines of "Log in to lightningfaucet.com?" Read the domain on that prompt. It is the wallet telling you which site will receive the signature, and it should say lightningfaucet.com.
If you are browsing on the same phone that holds your wallet, you cannot scan your own screen. Copy the LNURL text under the QR and paste it into your wallet, or long press it if your phone offers to open it in a Lightning app.
Step 3: approve the login
Tap the confirm button. Your wallet derives the linking key for our domain, signs the challenge, and sends the signature plus your public key straight to our server. Your browser is not involved in this step at all, which is a detail that matters later.
Step 4: wait for the page to catch up
While you were approving, the login page was quietly checking with our server to see whether the challenge had been answered. Once your wallet's signature arrives and verifies, the page picks up the new session and signs you in. Usually that takes a second or two. You will land on your account with a sat balance, ready to claim from the earn surfaces or sit down at a table.
That is the whole flow. There is no confirmation email and no form to fill in.
What happens on our server when you scan
Most explanations of LNURL-auth stop at "the wallet signs a challenge". Here is what that looks like from the operator's side, because it explains most of the edge cases players run into.
The challenge is single use and short lived
Every time the login page loads, we generate a new random challenge and store it with an expiry of five minutes. When a valid signature comes back for it, we mark it used. A used challenge cannot be answered twice, and an expired one is rejected outright. So if you left the login tab open while you made coffee and your wallet now says the login failed, the code simply timed out. Refresh the page to get a new QR and scan again.
This also means a screenshot of someone else's login QR is worthless once it has been used or has expired. The challenge is not a credential; it is a one time question.
We verify the signature, not the wallet brand
When your wallet calls back, it sends three things: the challenge, a signature, and your public linking key. We check that the challenge exists and is still fresh, then verify the secp256k1 signature against your public key. If the math checks out, the request is genuine regardless of which wallet app produced it. We do not keep an allowlist of wallets. Any wallet that implements the standard correctly will work.
First scan creates, later scans log in
If we have never seen your linking key before, we create a new account tied to it and sign you in. If we have seen it, we sign you into the existing account. There is no separate "sign up" button for wallet login because there does not need to be. The same scan does both jobs.
That is why the most common support question about wallet login is really a question about which wallet was used. If a player says "I logged in and my balance is gone", the answer is almost always that they scanned with a different wallet app than last time, which produced a different linking key, which created a brand new empty account. The original account is still there with its balance intact.
Account restrictions still apply
Wallet login does not bypass account safety checks. If an account has been restricted, signing the challenge correctly does not unlock it, and the wallet will show an error. Likewise, a wallet that is already linked to one account cannot be linked to a second account. We refuse that request and explain why rather than silently merging two accounts.
One key per site: the privacy property most guides skip
Your wallet uses a different identity for every domain
Wallets that follow the LNURL-auth key derivation spec derive the linking key from your wallet's master key plus the domain name of the site asking. The result is that the public key Lightning Faucet sees is different from the one any other site sees, even though the same wallet produced both. Two sites cannot compare notes and discover that the same person uses both, because the keys do not match.
Why that matters for you on Lightning Faucet
It means your login identity here is not your node ID, not a payment address, and not anything a block explorer can link to your funds. Logging in reveals nothing about your wallet balance or payment history. Your Lightning Faucet balance and your wallet balance are separate things: logging in proves who you are, and deposits and withdrawals move sats between the two when you choose to.
The flip side: the key belongs to the wallet
Because the linking key is derived inside the wallet, it moves with the wallet, not with you. Restore the same wallet from its backup and you usually get the same key back. Install a different wallet app and you get a different key. Keep that in mind before you switch apps, and see the section on changing wallets below.
Which wallets support Lightning login
Wallets players commonly use with our login
These wallets are widely used for LNURL-auth logins, and they are the ones we see most often:
- Wallet of Satoshi. Scan the QR from the main screen and approve the login prompt. Because it is a custodial wallet, your linking key is tied to your Wallet of Satoshi account, so logging into that account on a new phone keeps the same identity.
- Phoenix. Scan from the home screen. Phoenix derives the key from your wallet seed, so restoring Phoenix from its recovery words restores the same login.
- Zeus. Scan from the main screen. The key comes from the node or wallet Zeus is connected to, so make sure you are on the same connection each time you log in.
- Alby. The browser extension can answer a login on a desktop without a phone at all: the extension detects the login request and asks you to approve it. Alby Go on mobile scans like any other wallet.
Wallet features change between versions, so if a wallet does not recognize the QR, update it first. If it still treats the code as an unknown format, that wallet does not support LNURL-auth and you will need a different one for login.
How to tell if your wallet supports it
The quick test is simply to scan. A supporting wallet shows a login or authorization prompt naming the site's domain. An unsupported one shows an error, tries to treat the code as a payment, or does nothing. Nothing bad happens in any of those cases. A login challenge cannot spend sats; signing it only proves you hold the key.
Linking a wallet to an existing account, or switching wallets
Adding wallet login to an email account
If you originally signed up with an email address, you can add wallet login to the same account. Log in with email first, then start the wallet login from inside your account. Because the challenge was created while you were already signed in, we link the new wallet key to your current account instead of creating a new one. From then on either method gets you into the same balance.
Do this from inside your account, not from the logged out login page. A scan from the logged out page with a wallet we have never seen will create a separate account, as described above.
Changing to a different wallet app
Moving to a new wallet app means a new linking key, so we offer a wallet swap from your account settings. You scan a swap QR with the new wallet, and we move your account to the new key. A few safeguards apply, and they exist because a wallet swap is the most sensitive change an account can make:
- You need a verified email on the account before you can swap.
- Swaps have a seven day cooldown between them.
- We send an alert and a confirmation to your verified email whenever a swap happens, so you would know if it was not you.
- The old key is not orphaned. It is redirected to your account, so a later scan with the old wallet still finds you rather than creating an empty new account.
If you lose your wallet
If your wallet is gone and you never set up a backup, the linking key is gone with it, and that key was your login. This is the one real downside of passwordless login and the reason we recommend adding and verifying an email on any account that holds a balance you care about. Recovery words for your wallet are the other half of the answer: restore the same wallet from its backup and the same login key comes back.
Using your account once you are in
Everything works the same as any other login
A wallet login is a full account, not a guest mode. You can claim the faucet, play Lightning poker against real players, place sat-denominated positions on prediction markets, or roll provably fair dice where you can check every result yourself from the server seed, your client seed, and the nonce.
Withdrawals use the same scan habit
Once you are used to scanning a login QR, withdrawing feels familiar. Our withdrawals use LNURL-withdraw: you scan a withdrawal QR or tap the link, and your wallet fetches the invoice from us automatically. You never need to create an invoice by hand. Login and withdrawal are separate requests, though. A login prompt never moves sats, and a withdrawal prompt is clearly labeled as receiving a payment.
Troubleshooting a wallet login that will not complete
The wallet says the login failed
The most likely cause is that the QR expired. Challenges last five minutes and work once. Refresh the login page and scan the new code.
The wallet says success but the page does not change
Your wallet talks to our server directly, and the browser learns about it by checking back. If the page stays on the QR after your wallet reported success, give it a few seconds, then reload. If you are now signed in after the reload, the browser simply missed the update. If you are not, start a fresh login.
I logged in but my balance is zero
Check which wallet you used. A different wallet app, or the same app connected to a different node, produces a different key and a different account. Log out, scan with the wallet you used originally, and your balance will be there. If you want both wallets to reach one account, use the wallet swap from inside the original account.
The wallet says it is already linked to another account
That wallet's key belongs to a different Lightning Faucet account. Log out and scan with that wallet from the logged out login page to reach the account it belongs to.
If none of these fit, contact support with the approximate time you tried to log in, and we can look up what happened to that challenge on our side.
Why we built login this way
Fewer moving parts for players
Most of our players already hold a Lightning wallet because that is how they deposit and withdraw. Asking them to also invent a password and confirm an email before they can claim their first sats adds friction and an extra secret to lose. With LNURL-auth the wallet they already trust is the account key.
Less for anyone to steal
We cannot leak a password we never had. The public linking keys we store are useless to an attacker, and every login challenge is random, single use, and expires in minutes. For a site that holds player balances, removing the shared secret entirely is a meaningful security improvement, not just a convenience.
Ready to try it? Open the Lightning wallet login, scan with your wallet, and you will have an account before you finish reading this sentence.