Email then birthday

Step 1 is email. Step 2 is birthday, optional name, and password (8+).

Buyers must be 13+

The birthday gate is the same 13+ consumer rule. This is not Kids guardian consent.

Display name defaults from email

Name is optional. The local-part becomes the display name when blank.

Signup lands on verify email

After create, web signs in and routes to /verify. Native waits for the verification deep link.

Redirects stay on Kumir

redirectFromSearch only allows same-origin paths. Default return is home.

Not Create a business account

Brands use /business/signup. This chrome stays on personal Kumir.

Not Log in

Already have an account? /login. Signup does not verify an existing password.

Not talent enroll

/enroll is supply. Signup does not open a studio queue.

SSO stays hidden until configured

Google/Apple buttons stay off until AUTH_GOOGLE_* / AUTH_APPLE_* exist. Never fake SSO.

/signup is reserved, not a username

Get started and nav Sign up go here. That path is reserved, like /login and /forgot.

The form never fakes a fan row

Create runs the 13+ gate. It does not mint a User without a valid birthday.

Native uses the same register API

iOS OnboardBirthdayStep and Android splash call POST /api/v1/auth/register. Same 13+ birthday.