Account & launcher portal
RYVAKAI is a native Unreal Engine 5 client. It does not run in a browser, it is not streamed, and there is no plan to make it either.
This page is the portal around it: it holds your account, creates the characters the game server will load, and tells you whether there is a server to load them into. Everything else happens in the client you downloaded.
Reading the publish manifest…
Downloads what is actually published on this host and verifies every
byte against the publisher's SHA-256 before calling it installed.
It logs everything it does to
%LOCALAPPDATA%\RYVAKAI\logs\launcher.log.
—
01 — Access
One account holds up to five characters. Passwords are hashed with argon2id server-side; this page never sees, stores or transmits anything but what you typed, over HTTPS.
01 — Account
02 — Characters
Five archetypes, one shared resource budget split five ways. The archetype fixes your starting Vitality, Stamina and Veil, your pack size and the Technique you begin with — all applied server-side from the backend's own catalogue.
03 — Servers
Contacting the RYVAKAI API…
The registry is fed by heartbeats from each game server: player count, tick rate and uptime are what that process last reported, not an estimate. Entries expire on their own, so a server that dies mid-session leaves no phantom row behind.
You have an account and at least one character. Launch the native client against the endpoint below; the game server exchanges your join ticket with the backend and loads the character you pick in-game.
RYVAKAI.exe ryvakai.com:777704 — Notes
Tokens
The access token lives in this page's memory for the lifetime of the tab and is never written to local storage, a cookie, or the URL. If you tick "stay signed in", the refresh token goes to tab-scoped session storage, which is cleared when you close the tab — never to local storage, which would survive indefinitely on a shared machine.
Renewal
Access tokens are short-lived and renewed a minute before they expire. Refresh tokens are single-use and rotated: presenting one twice looks exactly like a stolen token being replayed, and the backend responds by revoking the entire session family. The portal therefore serialises renewals strictly, so it can never lock you out of your own account by racing itself.
Privacy
This site loads no external script, font, stylesheet, image or analytics. The content security policy at the edge forbids it, and the pages are built so there is nothing to forbid: every request goes to this origin.
Limits
Authentication is limited per IP address and the general API is limited per token. If you are told to wait, waiting is the fix — retrying faster extends the window rather than shortening it.