Username and avatar

Username rules

• 3 to 20 characters, matching ^[a-z0-9_]+$ — lowercase letters, digits and underscore only.
• Displayed with an @ prefix, which is not part of the stored value.
• Availability is checked live against GET /api/user-auth/username-available, debounced 420 ms, answering @name is available. or That username is already taken.
• A list of reserved names is refused — administrative and platform handles that a player could otherwise impersonate.
• If the check has not completed when you continue, the message is @name will be checked when you continue. and the server decides.

Avatar rules

Any profile patch outside sign-up validates the URL instead: it must be at most 600 characters and must match ^https://res\.cloudinary\.com/[a-z0-9_-]+/. A data: URI or your own host is rejected.

1. Pick. PNG, JPEG, WebP or GIF, at most 3 MB — above that the page says Please keep your profile picture under 3 MB.
2. Upload. Straight to Cloudinary, into the store's avatar folder.
3. Derive. The stored avatarUrl is a 256 × 256 face crop of what you uploaded.
4. Store. photoURL and avatarUrl are both written to the account.

Neither can be changed later

The store settings page has no username field and no avatar field, so the finish step is the only chance. The API route exists; the interface does not.

Consequences worth stating to users: a handle chosen at 2 AM is permanent, and a picture you dislike cannot be removed without creating a new account.

Where each one appears

The profile menu today leads with the display name, so two players with the same display name are indistinguishable in most surfaces. The username is the unique value; the display name is not.