VITON ID: one account for sign-in, orders, messages and bonuses

viton13.com needed one account for everything a customer does on the site: sign in, follow orders, discuss a service with the studio and keep bonuses. The studio needed one place to answer those conversations, manage members and send consent-based email.

This is our own product. VITON¹³ designed, built and runs VITON ID for its own site; no client commissioned it.

We defined the VITON ID number itself: 13 digits for the account type, the registration year, day and month, a five-digit sequence and a Luhn check digit. Members sign in with an email address or that number plus a password (Firebase Identity Toolkit). A new account is confirmed with a code sent by email, disposable and undeliverable email domains are refused, and a forgotten password is reset by email. In any 15 minutes, one IP address gets 5 failed sign-ins per identifier and 30 attempts in total.

Around the account we built the cabinet: ten views (Overview, Requests, Messages, the VIT LIVE assistant, Saved, Bag, Orders, Health, Profile and Settings) and an eleventh, the Console, that only admins see. A signed-in member can add a phone number and verify it through Firebase Phone Auth with an invisible reCAPTCHA.

In the Console, admins read site traffic from first-party counters, grant or deduct bonuses with a written reason, suspend or restore members, delete requests and send consent-based email broadcasts in batches of 50, each with a signed one-click unsubscribe. The Console is admin-gated and loads only when it is opened.

Ordering a service through VITON ID opens a conversation with the studio inside the cabinet, and the link is kept if the customer has to sign in first. A new message appears at once and is confirmed in the background; after that only newer messages are fetched, over one live channel shared across the cabinet. When the studio replies, the customer gets an email, at most once per conversation every 10 minutes. Visitors without an account can use the direct line: a guest thread authenticated by a token hash, limited to 10 requests per hour per IP address and 5 per hour per email, with a honeypot for bots.

Files attached to a studio order (up to three: PDF, JPEG, PNG, WebP or text, 1.5 MB each and 3 MB in total) and the brief are encrypted in the browser with AES-GCM-256 through Web Crypto. Only ciphertext is uploaded; the key travels in the link's #fragment, which browsers do not send to the server.

Checkout submissions are synced to the buyer's VITON ID profile and listed under Orders; payment is agreed by hand. Every account receives 13 VITO once, at 13 VITO = $1, and the balance keeps a 20-entry ledger. Nothing is spent automatically: the studio honours the balance when it invoices.

The sign-in page is live at viton13.com/viton-id and answers with noindex, nofollow, so it stays out of search results. The cabinet's copy exists in four languages.

On 19 September 2026 the automated tests for the ID format (11 of 11), the emailed codes (3 of 3), phone linking (5 of 5), the service order flow (10 of 10), VITO bonuses (7 of 7) and the encryption (4 of 4) passed.

There is no payment layer: payment for an order is agreed by hand, and VITO bonuses cannot be spent online. Encryption covers order attachments and briefs only, and whoever holds the full link, the studio included, can decrypt them; the cabinet as a whole is not end-to-end encrypted.

A phone number is linked after sign-in and is not a way to sign in; there is no Google, Apple or social login. Everything behind sign-in was checked in the code and its tests, not in a live session, and this case quotes no member, order or revenue figures.

How to check a web studio’s portfolio →