HTTPS on cinderkin.io
Our official website uses HTTPS to encrypt information in transit. Check the address in your browser before entering account details. HTTPS protects the connection; it is not a guarantee that every site or NFT is trustworthy.
KEEP YOUR FIRE SAFEClear steps.
Clear steps.
Safer connections.
Know what you’re connecting to, what you’re signing, and where your payment goes.
What protects your visit
Sign a message to use the Forge
Forge sign-in uses a one-time wallet message and checks your Cinderkin ownership on Ethereum. Signing in does not require a transaction, gas payment, token transfer or spending approval. Read the message before signing.
Stripe-hosted checkout
Optional paid Forge packs open a Stripe-hosted checkout. Payment details go to Stripe; Cinderkin does not receive your full card number. Stripe handles pack payments, not NFT minting. Wallet verification happens separately.
Your account stays yours
Your Army account uses your Ethereum address and a private access code. That code is shown once; save it in a password manager. We store a hash of the code, not the original. Entering an Ethereum address in the Army account form does not prove wallet ownership or unlock the holder Forge.
Sign-in sessions use expiring, HttpOnly cookies. Owner tools require the owner’s authenticated account; a private page address alone never grants access.
Three things we will never need
- Your wallet recovery phrase or private key.
- A transfer to “verify” your wallet or activate a free Forge pack.
- Your Army private access code in a public post, comment or direct message.
Minting is different from signing in.
Minting a Cinderkin happens through our official OpenSea collection and is an Ethereum transaction with a mint price and gas. Forge message sign-in is not a mint transaction. Paid early access never changes Devilution.
Start from the official links
Use Cinderkin’s official links and our wallet & minting guide. If a request feels unexpected, stop and check before approving it.
Report a suspected site issue to The1DreamerLabs@gmail.com. Describe the page and what happened, without sending passwords, access codes, wallet secrets or payment details.
These are the protections and practices used by the site, not an independent security certification. No website can promise zero risk.