diff --git a/src/components/main-nav/theme-switcher.tsx b/src/components/main-nav/theme-switcher.tsx
index f54ad562..56fc0482 100644
--- a/src/components/main-nav/theme-switcher.tsx
+++ b/src/components/main-nav/theme-switcher.tsx
@@ -1,6 +1,6 @@
 import { Moon, Sun } from 'lucide-solid';
 import { type Component, Show } from 'solid-js';
-import { COOKIE_NAME_THEME } from '~/lib/cookies/cookie-names';
+import { COOKIE_THEME } from '~/lib/cookies/cookie-names';
 import { cookiesClientSet } from '~/lib/cookies/cookies-client';
 import { useThemeStore } from '~/lib/viz/store/theme-store';
 import { Button } from '../ui/button';
@@ -14,7 +14,7 @@ export const ThemeSwitcher: Component = () => {
 	function toggleTheme() {
 		const theme = themeStore.currentTheme() === 'light' ? 'dark' : 'light';
 		themeStore.setCurrentTheme(theme);
-		cookiesClientSet(COOKIE_NAME_THEME, theme, 365 * 5);
+		cookiesClientSet(COOKIE_THEME, theme, 365 * 5);
 	}
 
 	return (
diff --git a/src/entry-server.tsx b/src/entry-server.tsx
index 768b948c..1a9d0f1a 100644
--- a/src/entry-server.tsx
+++ b/src/entry-server.tsx
@@ -2,12 +2,20 @@
 import { createHandler, StartServer } from '@solidjs/start/server';
 import { FaviconsHead } from './components/favicons-head';
 import { serverCookiesGetSyncDontUse } from './lib/cookies/cookies-server';
+import { COOKIE_THEME } from './lib/cookies/cookie-names';
+
+const jsonLd = JSON.stringify({
+	'@context': 'https://schema.org',
+	'@type': 'WebSite',
+	url: 'https://www.hkviz.org',
+	name: 'HKViz',
+});
 
 export default createHandler(() => {
 	return (
 		<StartServer
 			document={({ assets, children, scripts }) => {
-				const theme = serverCookiesGetSyncDontUse().get('theme') === 'light' ? 'light' : 'dark';
+				const theme = serverCookiesGetSyncDontUse().getSafe(COOKIE_THEME);
 
 				return (
 					<html lang="en">
@@ -15,6 +23,8 @@ export default createHandler(() => {
 							<meta charset="utf-8" />
 							<meta name="viewport" content="width=device-width, initial-scale=1" />
 							<link rel="icon" href="/favicon.ico" />
+							{/* eslint-disable-next-line solid/no-innerhtml */}
+							<script type="application/ld+json" innerHTML={jsonLd} />
 							<FaviconsHead theme={theme} />
 							{assets}
 						</head>
diff --git a/src/lib/cookies/cookie-names.ts b/src/lib/cookies/cookie-names.ts
index 00e102b3..33e58130 100644
--- a/src/lib/cookies/cookie-names.ts
+++ b/src/lib/cookies/cookie-names.ts
@@ -1,2 +1,51 @@
-export const COOKIE_NAME_INGAME_AUTH_URL_ID = 'ingameAuthUrlId';
-export const COOKIE_NAME_THEME = 'theme';
+import * as v from 'valibot';
+
+export class CookieDefinition<T> {
+	readonly name: string;
+	readonly schema: v.BaseSchema<string | null | undefined, T, v.BaseIssue<unknown>>;
+	readonly maxAge: number;
+	readonly httpOnly: boolean;
+	readonly sameSite: 'strict' | 'lax' | 'none';
+
+	constructor({
+		name,
+		schema,
+		maxAge,
+		httpOnly,
+		sameSite,
+	}: {
+		name: string;
+		schema: v.BaseSchema<string | null | undefined, T, v.BaseIssue<unknown>>;
+		maxAge?: number;
+		httpOnly?: boolean;
+		sameSite?: 'strict' | 'lax' | 'none';
+	}) {
+		this.name = name;
+		this.schema = schema;
+		this.maxAge = maxAge ?? 60 * 60 * 24 * 365 * 1; // 1 year
+		this.httpOnly = httpOnly ?? true;
+		this.sameSite = sameSite ?? 'strict';
+	}
+}
+
+export type CookieNameLike = string | CookieDefinition<unknown>;
+export function getCookieName(name: CookieNameLike): string {
+	return typeof name === 'string' ? name : name.name;
+}
+
+export const COOKIE_INGAME_AUTH_URL_ID = new CookieDefinition({
+	name: 'ingameAuthUrlId',
+	schema: v.nullish(v.pipe(v.string(), v.uuid())),
+	maxAge: 60 * 15, // 15 minutes
+	sameSite: 'lax', // not quite sure why this needs to be lax, but the cookie seems to be not present after the redirect from the discord login
+});
+
+export const COOKIE_THEME = new CookieDefinition({
+	name: 'theme',
+	schema: v.pipe(
+		v.nullish(v.string()),
+		v.transform((v) => (v === 'light' ? 'light' : 'dark')),
+	),
+	maxAge: 60 * 60 * 24 * 365 * 10, // 10 year
+	httpOnly: false,
+});
diff --git a/src/lib/cookies/cookies-client.ts b/src/lib/cookies/cookies-client.ts
index 27ec4858..f79c26d2 100644
--- a/src/lib/cookies/cookies-client.ts
+++ b/src/lib/cookies/cookies-client.ts
@@ -1,4 +1,8 @@
-export function cookiesClientSet(name: string, value: string, days: number) {
+import { CookieDefinition, CookieNameLike, getCookieName } from './cookie-names';
+import * as v from 'valibot';
+
+export function cookiesClientSet(name: CookieNameLike, value: string, days: number) {
+	const _name = getCookieName(name);
 	let expires: string;
 	if (days) {
 		const date = new Date();
@@ -7,21 +11,21 @@ export function cookiesClientSet(name: string, value: string, days: number) {
 	} else {
 		expires = '';
 	}
-	document.cookie = name + '=' + value + expires + '; path=/';
+	document.cookie = _name + '=' + value + expires + '; path=/';
 }
 
-export function cookiesClientRead(name: string) {
-	const nameEQ = name + '=';
+export function cookiesClientRead<T>(definition: CookieDefinition<T>): T {
+	const nameEQ = definition.name + '=';
 	const ca = document.cookie.split(';');
 	for (let c of ca) {
 		while (c.startsWith(' ')) {
 			c = c.substring(1, c.length);
 		}
 		if (c.startsWith(nameEQ)) {
-			return c.substring(nameEQ.length, c.length);
+			return v.parse(definition.schema, c.substring(nameEQ.length, c.length));
 		}
 	}
-	return null;
+	return v.parse(definition.schema, null);
 }
 
 export function cookiesClientDelete(name: string) {
diff --git a/src/lib/cookies/cookies-response-helpers.ts b/src/lib/cookies/cookies-response-helpers.ts
index 50e26143..59adff6f 100644
--- a/src/lib/cookies/cookies-response-helpers.ts
+++ b/src/lib/cookies/cookies-response-helpers.ts
@@ -1,16 +1,35 @@
-import { CustomResponse, json, RouterResponseInit } from '@solidjs/router';
+import { CustomResponse, json, redirect, RouterResponseInit } from '@solidjs/router';
 import { ServerCookies } from './cookies-server';
 import { combineHeaders } from './headers';
 
-export function jsonWithCookies<T>(data: T, cookies: ServerCookies, init?: RouterResponseInit): CustomResponse<T> {
+export function withCookies(
+	cookies: ServerCookies,
+	init?: RouterResponseInit | undefined,
+): RouterResponseInit | undefined {
 	let initModified = init;
 
 	const headers = cookies.getSetHeaders();
+	console.log({ headers });
 
 	if (headers.length) {
 		initModified ??= {};
 		initModified.headers = combineHeaders(initModified.headers, headers);
 	}
 
+	return initModified;
+}
+
+export function jsonWithCookies<T>(data: T, cookies: ServerCookies, init?: RouterResponseInit): CustomResponse<T> {
+	const initModified = withCookies(cookies, init);
+	console.log(JSON.stringify({ initModified }, null, 2));
 	return json(data, initModified);
 }
+
+export function redirectWithCookies(
+	url: string,
+	cookies: ServerCookies,
+	init?: RouterResponseInit,
+): CustomResponse<never> {
+	const initModified = withCookies(cookies, init);
+	return redirect(url, initModified);
+}
diff --git a/src/lib/cookies/cookies-server.test.ts b/src/lib/cookies/cookies-server.test.ts
index ab5ec396..56c3c308 100644
--- a/src/lib/cookies/cookies-server.test.ts
+++ b/src/lib/cookies/cookies-server.test.ts
@@ -1,6 +1,8 @@
 import { revalidate } from '@solidjs/router';
 import { afterAll, beforeEach, expect, test, vi } from 'vitest';
 import { serverCookiesGet } from './cookies-server';
+import { CookieDefinition } from './cookie-names';
+import * as v from 'valibot';
 
 let currentCookieHeader = '';
 vi.mock('vinxi/http', async (importOriginal) => {
@@ -21,6 +23,16 @@ beforeEach(() => {
 	revalidate(serverCookiesGet.key);
 });
 
+const COOKIE_NAME = new CookieDefinition({
+	name: 'name',
+	schema: v.string(),
+});
+
+const COOKIE_NAME2 = new CookieDefinition({
+	name: 'name2',
+	schema: v.string(),
+});
+
 test('parses simple cookies', async () => {
 	currentCookieHeader = 'name=value; name2=value2'; // update for this test
 	const cookies = await serverCookiesGet();
@@ -53,8 +65,10 @@ test('parses cookies with spaces', async () => {
 
 test('sets cookie correctly', async () => {
 	const cookies = await serverCookiesGet();
-	cookies.set('name', 'value');
-	expect(cookies.getSetHeaders()).toEqual([['Set-Cookie', 'name=value']]);
+	cookies.set(COOKIE_NAME, 'value');
+	expect(cookies.getSetHeaders()).toEqual([
+		['Set-Cookie', 'name=value; Max-Age=31536000; Path=/; HttpOnly; SameSite=Strict'],
+	]);
 	expect(cookies.getAll()).toEqual(new Map([['name', 'value']]));
 });
 
@@ -63,19 +77,19 @@ test('deletes cookie correctly', async () => {
 	const cookies = await serverCookiesGet();
 	cookies.delete('name');
 
-	expect(cookies.getSetHeaders()).toEqual([['Set-Cookie', 'name=; Max-Age=-1']]);
+	expect(cookies.getSetHeaders()).toEqual([['Set-Cookie', 'name=; Max-Age=-1; Path=/']]);
 	expect(cookies.getAll()).toEqual(new Map());
 });
 
 test('deduplicates set headers', async () => {
 	// initial values
 	const cookies = await serverCookiesGet();
-	cookies.set('name', 'value');
-	cookies.set('name2', 'value2');
+	cookies.set(COOKIE_NAME, 'value');
+	cookies.set(COOKIE_NAME2, 'value2');
 
 	expect(cookies.getSetHeaders()).toEqual([
-		['Set-Cookie', 'name=value'],
-		['Set-Cookie', 'name2=value2'],
+		['Set-Cookie', 'name=value; Max-Age=31536000; Path=/; HttpOnly; SameSite=Strict'],
+		['Set-Cookie', 'name2=value2; Max-Age=31536000; Path=/; HttpOnly; SameSite=Strict'],
 	]);
 	expect(cookies.getAll()).toEqual(
 		new Map([
@@ -85,11 +99,11 @@ test('deduplicates set headers', async () => {
 	);
 
 	// update values
-	cookies.set('name', 'new-value');
+	cookies.set(COOKIE_NAME, 'new-value');
 
 	expect(cookies.getSetHeaders()).toEqual([
-		['Set-Cookie', 'name=new-value'],
-		['Set-Cookie', 'name2=value2'],
+		['Set-Cookie', 'name=new-value; Max-Age=31536000; Path=/; HttpOnly; SameSite=Strict'],
+		['Set-Cookie', 'name2=value2; Max-Age=31536000; Path=/; HttpOnly; SameSite=Strict'],
 	]);
 	expect(cookies.getAll()).toEqual(
 		new Map([
@@ -102,8 +116,8 @@ test('deduplicates set headers', async () => {
 	cookies.delete('name');
 
 	expect(cookies.getSetHeaders()).toEqual([
-		['Set-Cookie', 'name=; Max-Age=-1'],
-		['Set-Cookie', 'name2=value2'],
+		['Set-Cookie', 'name=; Max-Age=-1; Path=/'],
+		['Set-Cookie', 'name2=value2; Max-Age=31536000; Path=/; HttpOnly; SameSite=Strict'],
 	]);
 	expect(cookies.getAll()).toEqual(new Map([['name2', 'value2']]));
 });
@@ -138,7 +152,7 @@ test('does not parse cookies if getHeaders is called', async () => {
 test('does not parse cookies when reading already set cookie', async () => {
 	currentCookieHeader = 'name=value';
 	const cookies = await serverCookiesGet();
-	cookies.set('name2', 'value2');
+	cookies.set(COOKIE_NAME2, 'value2');
 	expect(cookies.get('name2')).toBe('value2');
 	expect(cookies.didParse).toBe(false);
 });
@@ -154,7 +168,7 @@ test('does not parse cookies when reading already set cookie', async () => {
 test('does not overwrite already set cookie when parsing after set', async () => {
 	currentCookieHeader = 'name=value; name2=value2';
 	const cookies = await serverCookiesGet();
-	cookies.set('name', 'new-value');
+	cookies.set(COOKIE_NAME, 'new-value');
 	expect(cookies.get('name')).toBe('new-value');
 	expect(cookies.didParse).toBe(false);
 
diff --git a/src/lib/cookies/cookies-server.ts b/src/lib/cookies/cookies-server.ts
index a3288aa7..ce2f8668 100644
--- a/src/lib/cookies/cookies-server.ts
+++ b/src/lib/cookies/cookies-server.ts
@@ -1,6 +1,8 @@
 import { query } from '@solidjs/router';
 import { parse, serialize } from 'cookie';
-import { getWebRequest } from 'vinxi/http';
+import * as v from 'valibot';
+import { CookieSerializeOptions, getWebRequest } from 'vinxi/http';
+import { CookieDefinition, CookieNameLike, getCookieName } from './cookie-names';
 
 export class ServerCookies {
 	#cookies = new Map<string, string>();
@@ -32,16 +34,24 @@ export class ServerCookies {
 		}
 	}
 
-	set(name: string, value: string, options: { maxAge?: number } = {}) {
-		const setCookieHeader = serialize(name, value, options);
-		this.#setHeaders.set(name, ['Set-Cookie', setCookieHeader]);
-		this.#cookies.set(name, value);
+	set<T>(definition: CookieDefinition<T>, value: string, options: CookieSerializeOptions = {}) {
+		const optionsWithDefaults = options ?? {};
+		optionsWithDefaults.path ??= '/';
+		optionsWithDefaults.httpOnly ??= definition.httpOnly;
+		optionsWithDefaults.sameSite ??= definition.sameSite;
+		optionsWithDefaults.maxAge ??= definition.maxAge;
+
+		const _name = getCookieName(definition);
+		const setCookieHeader = serialize(_name, value, options);
+		this.#setHeaders.set(_name, ['Set-Cookie', setCookieHeader]);
+		this.#cookies.set(_name, value);
 	}
 
-	delete(name: string) {
-		const deleteCookieHeader = serialize(name, '', { maxAge: -1 });
-		this.#setHeaders.set(name, ['Set-Cookie', deleteCookieHeader]);
-		this.#cookies.delete(name);
+	delete(name: CookieNameLike) {
+		const _name = typeof name === 'string' ? name : name.name;
+		const deleteCookieHeader = serialize(_name, '', { maxAge: -1, path: '/' });
+		this.#setHeaders.set(_name, ['Set-Cookie', deleteCookieHeader]);
+		this.#cookies.delete(_name);
 	}
 
 	get(name: string): string | undefined {
@@ -51,6 +61,11 @@ export class ServerCookies {
 		return this.#cookies.get(name);
 	}
 
+	getSafe<T>(definition: CookieDefinition<T>): T {
+		const value = this.get(definition.name);
+		return v.parse(definition.schema, value);
+	}
+
 	getAll(): ReadonlyMap<string, string> {
 		this.#ensureParsed();
 		return this.#cookies;
diff --git a/src/lib/viz/store/theme-store.tsx b/src/lib/viz/store/theme-store.tsx
index d4840ee6..0a1c3845 100644
--- a/src/lib/viz/store/theme-store.tsx
+++ b/src/lib/viz/store/theme-store.tsx
@@ -1,5 +1,5 @@
 import { createContext, createEffect, createSignal, untrack, useContext } from 'solid-js';
-import { COOKIE_NAME_THEME } from '~/lib/cookies/cookie-names';
+import { COOKIE_THEME } from '~/lib/cookies/cookie-names';
 import { cookiesClientRead } from '~/lib/cookies/cookies-client';
 // import { effect } from 'solid-js/web';
 // import { COOKIE_NAME_THEME } from '~/lib/cookies/cookie-names';
@@ -26,7 +26,7 @@ export function createThemeStore() {
 
 	createEffect(() => {
 		untrack(() => {
-			const theme = cookiesClientRead(COOKIE_NAME_THEME) === 'light' ? 'light' : 'dark';
+			const theme = cookiesClientRead(COOKIE_THEME);
 			setCurrentTheme(theme);
 		});
 	});
diff --git a/src/routes/api/rest/ingameauth/init.ts b/src/routes/api/rest/ingameauth/init.ts
index 7b85380f..856000d5 100644
--- a/src/routes/api/rest/ingameauth/init.ts
+++ b/src/routes/api/rest/ingameauth/init.ts
@@ -4,6 +4,6 @@ import { ingameAuthInit } from '~/server/ingameauth/init';
 export async function POST({ request }: APIEvent) {
 	const body: unknown = await request.json();
 	// will be validated by valibot, so ok to pass any
-	 
+
 	return await ingameAuthInit(body as any);
 }
diff --git a/src/routes/ingameauth/[urlId].tsx b/src/routes/ingameauth/[urlId].tsx
new file mode 100644
index 00000000..3ac11e08
--- /dev/null
+++ b/src/routes/ingameauth/[urlId].tsx
@@ -0,0 +1,7 @@
+import type { APIEvent } from '@solidjs/start/server';
+import { ingameAuthGetByUrlId } from '~/server/ingameauth/get-active-by-url-id-set-cookie';
+
+export async function GET({ params }: APIEvent) {
+	console.log('urkId', params.urlId);
+	return await ingameAuthGetByUrlId({ urlId: params.urlId });
+}
diff --git a/src/routes/ingameauth/flow/confirm.tsx b/src/routes/ingameauth/flow/confirm.tsx
new file mode 100644
index 00000000..83b2e482
--- /dev/null
+++ b/src/routes/ingameauth/flow/confirm.tsx
@@ -0,0 +1,88 @@
+import { Title } from '@solidjs/meta';
+import { useAction, useSubmission } from '@solidjs/router';
+import { createSignal, Match, Show, Switch } from 'solid-js';
+import { ContentCenterWrapper } from '~/components/content-wrapper';
+import { Button } from '~/components/ui/button';
+import { Card, CardContent, CardDescription, CardFooter, CardHeader, CardTitle } from '~/components/ui/card';
+import { useUser } from '~/lib/auth/client';
+import { ingameAuthAllowLogin } from '~/server/ingameauth/allow-login';
+import { ingameAuthCancelLogin } from '~/server/ingameauth/cancel-login';
+
+export default function IngameAuthPage() {
+	const allowMutation = useAction(ingameAuthAllowLogin);
+	const cancelMutation = useAction(ingameAuthCancelLogin);
+	const allowSubmission = useSubmission(ingameAuthAllowLogin);
+	const cancelSubmission = useSubmission(ingameAuthCancelLogin);
+
+	const user = useUser();
+
+	const [allowSuccess, setAllowSuccess] = createSignal(false);
+	const [cancelSuccess, setCancelSuccess] = createSignal(false);
+
+	const handleAllow = async () => {
+		allowSubmission.clear();
+		cancelSubmission.clear();
+
+		await allowMutation();
+		setAllowSuccess(true);
+	};
+
+	const handleCancel = async () => {
+		allowSubmission.clear();
+		cancelSubmission.clear();
+
+		await cancelMutation();
+		setCancelSuccess(true);
+	};
+
+	const isMutating = () => allowSubmission.pending || cancelSubmission.pending;
+
+	return (
+		<ContentCenterWrapper>
+			<Title>Login - HKViz</Title>
+			<Switch>
+				<Match when={allowSuccess()}>
+					<Card class="max-w-[500px]">
+						<CardHeader>
+							<CardTitle>Login successful</CardTitle>
+							<CardDescription>You can switch back to Hollow Knight now</CardDescription>
+						</CardHeader>
+					</Card>
+				</Match>
+				<Match when={cancelSuccess()}>
+					<Card class="max-w-[500px]">
+						<CardHeader>
+							<CardTitle>Login canceled</CardTitle>
+							<CardDescription>You can close this page now</CardDescription>
+						</CardHeader>
+					</Card>
+				</Match>
+				<Match when={true}>
+					<Card class="max-w-[500px]">
+						<CardHeader>
+							<CardTitle>Allow this device to upload play data?</CardTitle>
+							<CardDescription>
+								Data will be uploaded to{' '}
+								<Show when={user()} fallback={<span>your account</span>}>
+									{(user) => <span>the account {user().name}</span>}
+								</Show>
+							</CardDescription>
+						</CardHeader>
+						<CardContent>
+							{!!allowSubmission.error && <p class="text-red-600">Could not login</p>}
+							{!!cancelSubmission.error && <p class="text-red-600">Could not cancel login</p>}
+						</CardContent>
+						<CardFooter class="flex justify-between gap-2">
+							<Button class="grow" variant="outline" onClick={handleCancel} disabled={isMutating()}>
+								Cancel
+							</Button>
+							<Button class="grow" onClick={handleAllow} disabled={isMutating()}>
+								Allow
+							</Button>
+						</CardFooter>
+					</Card>
+				</Match>
+			</Switch>
+		</ContentCenterWrapper>
+	);
+}
diff --git a/src/routes/ingameauth/flow/not-found.tsx b/src/routes/ingameauth/flow/not-found.tsx
new file mode 100644
index 00000000..456f2df1
--- /dev/null
+++ b/src/routes/ingameauth/flow/not-found.tsx
@@ -0,0 +1,24 @@
+import { Title } from '@solidjs/meta';
+import { ContentCenterWrapper } from '~/components/content-wrapper';
+import { Card, CardContent, CardDescription, CardHeader, CardTitle } from '~/components/ui/card';
+
+export default function IngameAuthPage() {
+	return (
+		<ContentCenterWrapper>
+			<Title>Login - HKViz</Title>
+			<Card>
+				<CardHeader>
+					<CardTitle>This login link does not exist</CardTitle>
+					<CardDescription>This might be because one of the following reasons:</CardDescription>
+				</CardHeader>
+				<CardContent>
+					<ul class="list-inside list-disc text-sm text-muted-foreground">
+						<li>The link was already used to login</li>
+						<li>The link has expired (after 10 minutes)</li>
+						<li>The link has never existed</li>
+					</ul>
+				</CardContent>
+			</Card>
+		</ContentCenterWrapper>
+	);
+}
diff --git a/src/server/ingameauth/allow-login.ts b/src/server/ingameauth/allow-login.ts
index 612565ef..eb58fe6c 100644
--- a/src/server/ingameauth/allow-login.ts
+++ b/src/server/ingameauth/allow-login.ts
@@ -1,35 +1,34 @@
 import * as v from 'valibot';
 import { ingameAuth } from '~/server/db/schema';
 
+import { action } from '@solidjs/router';
 import { and, eq, isNull } from 'drizzle-orm';
 import { getUserOrThrow } from '~/lib/auth/shared';
-import { COOKIE_NAME_INGAME_AUTH_URL_ID } from '~/lib/cookies/cookie-names';
+import { COOKIE_INGAME_AUTH_URL_ID } from '~/lib/cookies/cookie-names';
 import { jsonWithCookies } from '~/lib/cookies/cookies-response-helpers';
 import { serverCookiesGet } from '~/lib/cookies/cookies-server';
 import { db } from '~/server/db';
 import { isMax10MinutesOld } from './utils';
+import { raise } from '~/lib/parser';
 
-const ingameAuthAllowLoginInputSchema = v.object({
-	id: v.pipe(v.string(), v.uuid()),
-});
-type IngameAuthAllowLoginInput = v.InferInput<typeof ingameAuthAllowLoginInputSchema>;
-
-export async function ingameAuthAllowLogin(unsafeInput: IngameAuthAllowLoginInput) {
-	const input = v.parse(ingameAuthAllowLoginInputSchema, unsafeInput);
+export const ingameAuthAllowLogin = action(async () => {
+	'use server';
 	const user = await getUserOrThrow();
-
 	const userId = user.id;
+
+	const cookies = await serverCookiesGet();
+	const urlId = cookies.getSafe(COOKIE_INGAME_AUTH_URL_ID) ?? raise(new Error('Login failed. No login id found.'));
+
 	const result = await db
 		.update(ingameAuth)
 		.set({ userId })
-		.where(and(eq(ingameAuth.id, input.id), isNull(ingameAuth.userId), isMax10MinutesOld()));
+		.where(and(eq(ingameAuth.urlId, urlId), isNull(ingameAuth.userId), isMax10MinutesOld()));
 
 	if (result.rowsAffected !== 1) {
 		throw new Error('Unexpected session state');
 	}
 
-	const cookies = await serverCookiesGet();
-	cookies.delete(COOKIE_NAME_INGAME_AUTH_URL_ID);
+	cookies.delete(COOKIE_INGAME_AUTH_URL_ID);
 
 	return jsonWithCookies({}, cookies);
-}
+});
diff --git a/src/server/ingameauth/cancel-login.ts b/src/server/ingameauth/cancel-login.ts
index 95e6738e..69773b8e 100644
--- a/src/server/ingameauth/cancel-login.ts
+++ b/src/server/ingameauth/cancel-login.ts
@@ -1,31 +1,28 @@
-import * as v from 'valibot';
 import { ingameAuth } from '~/server/db/schema';
 
+import { action } from '@solidjs/router';
 import { and, eq, isNull } from 'drizzle-orm';
-import { COOKIE_NAME_INGAME_AUTH_URL_ID } from '~/lib/cookies/cookie-names';
+import { COOKIE_INGAME_AUTH_URL_ID } from '~/lib/cookies/cookie-names';
 import { jsonWithCookies } from '~/lib/cookies/cookies-response-helpers';
 import { serverCookiesGet } from '~/lib/cookies/cookies-server';
+import { raise } from '~/lib/parser';
 import { db } from '~/server/db';
 import { isMax10MinutesOld } from './utils';
 
-const ingameAuthCancelLoginInputSchema = v.object({
-	id: v.pipe(v.string(), v.uuid()),
-});
-type IngameAuthCancelLoginInput = v.InferInput<typeof ingameAuthCancelLoginInputSchema>;
+export const ingameAuthCancelLogin = action(async () => {
+	'use server';
+	const cookies = await serverCookiesGet();
+	const urlId = cookies.getSafe(COOKIE_INGAME_AUTH_URL_ID) ?? raise(new Error('Login failed. No login id found.'));
 
-export async function ingameAuthCancelLogin(unsafeInput: IngameAuthCancelLoginInput) {
-	const input = v.parse(ingameAuthCancelLoginInputSchema, unsafeInput);
 	const result = await db
 		.delete(ingameAuth)
-		.where(and(eq(ingameAuth.id, input.id), isNull(ingameAuth.userId), isMax10MinutesOld()));
+		.where(and(eq(ingameAuth.urlId, urlId), isNull(ingameAuth.userId), isMax10MinutesOld()));
 
 	if (result.rowsAffected !== 1) {
 		throw new Error('Unexpected session state');
 	}
 
-	const cookies = await serverCookiesGet();
-
-	cookies.delete(COOKIE_NAME_INGAME_AUTH_URL_ID);
+	cookies.delete(COOKIE_INGAME_AUTH_URL_ID);
 
 	return jsonWithCookies({}, cookies);
-}
+});
diff --git a/src/server/ingameauth/get-active-by-url-id-set-cookie.ts b/src/server/ingameauth/get-active-by-url-id-set-cookie.ts
new file mode 100644
index 00000000..adcd173f
--- /dev/null
+++ b/src/server/ingameauth/get-active-by-url-id-set-cookie.ts
@@ -0,0 +1,87 @@
+import { and, eq, isNull } from 'drizzle-orm';
+import { v4 as uuidv4 } from 'uuid';
+import * as v from 'valibot';
+import { getSessionOrNull } from '~/lib/auth/shared';
+import { COOKIE_INGAME_AUTH_URL_ID } from '~/lib/cookies/cookie-names';
+import { redirectWithCookies } from '~/lib/cookies/cookies-response-helpers';
+import { serverCookiesGet } from '~/lib/cookies/cookies-server';
+import { db } from '../db';
+import { ingameAuth } from '../db/schema';
+import { isMax10MinutesOld } from './utils';
+
+const ingameAuthGetForAuthUrlInputSchema = v.object({
+	urlId: v.union([v.pipe(v.string(), v.uuid()), v.literal('continue')]),
+});
+type IngameAuthGetForAuthUrlInput = v.InferInput<typeof ingameAuthGetForAuthUrlInputSchema>;
+
+export async function ingameAuthGetByUrlId(unsafeInput: IngameAuthGetForAuthUrlInput) {
+	'use server';
+	const input = v.parse(ingameAuthGetForAuthUrlInputSchema, unsafeInput);
+
+	const cookies = await serverCookiesGet();
+	const isUrlIdFromUrl = input.urlId != 'continue';
+	const urlId = isUrlIdFromUrl
+		? // when a urlId is provided use it
+			input.urlId
+		: // when no urlId is provided try to use the one from the cookie
+			cookies.getSafe(COOKIE_INGAME_AUTH_URL_ID);
+
+	if (urlId == null) {
+		return redirectWithCookies('/ingameauth/flow/not-found?1', cookies);
+	}
+
+	const session = await getSessionOrNull();
+	const hasSession = session != null;
+
+	console.log({ session, hasSession, isUrlIdFromUrl, urlId });
+
+	const result = await db.query.ingameAuth.findFirst({
+		where: (ingameAuth, { eq, and }) =>
+			and(eq(ingameAuth.urlId, urlId), isNull(ingameAuth.userId), isMax10MinutesOld()),
+		columns: {
+			id: true,
+			name: true,
+		},
+		with: {
+			user: {
+				columns: {
+					id: true,
+					name: true,
+				},
+			},
+		},
+	});
+
+	if (result == null) {
+		return redirectWithCookies('/ingameauth/flow/not-found?2', cookies);
+	}
+
+	if (isUrlIdFromUrl) {
+		// ---------- URL ID FROM URL ----------
+		// Here the url id was visible in the url bar of the browser.
+		// It should be ensured that the same url cannot be used again by anybody else.
+		// For example, if the person doing the login is streaming, nobody else should be able
+		// to login into their game.
+		const newUrlId = uuidv4();
+		const result = await db
+			.update(ingameAuth)
+			.set({ urlId: newUrlId })
+			.where(and(eq(ingameAuth.urlId, urlId), isNull(ingameAuth.userId), isMax10MinutesOld()));
+
+		if (result.rowsAffected !== 1) {
+			return redirectWithCookies('/ingameauth/flow/not-found?3', cookies);
+		}
+
+		cookies.set(COOKIE_INGAME_AUTH_URL_ID, newUrlId);
+	} else {
+		// ---------- URL ID FROM COOKIE ----------
+		// Here the url id was not visible in the url bar of the browser.
+		// It can be kept
+		cookies.set(COOKIE_INGAME_AUTH_URL_ID, urlId);
+	}
+	if (hasSession) {
+		return redirectWithCookies('/ingameauth/flow/confirm', cookies);
+	} else {
+		return redirectWithCookies('/api/auth/signin?callbackUrl=/ingameauth/continue', cookies);
+	}
+}
diff --git a/src/server/ingameauth/get-by-url-id-if-new.ts b/src/server/ingameauth/get-by-url-id-if-new.ts
index 9b10b03f..c00db7a6 100644
--- a/src/server/ingameauth/get-by-url-id-if-new.ts
+++ b/src/server/ingameauth/get-by-url-id-if-new.ts
@@ -8,7 +8,7 @@ const ingameAuthGetByUrlIdIfNewSchema = v.object({
 });
 type IngameAuthGetByUrlIdIfNewInput = v.InferInput<typeof ingameAuthGetByUrlIdIfNewSchema>;
 
-export async function ingameAuthGetByUrlIdIfNew(unsafeInput: IngameAuthGetByUrlIdIfNewInput) {
+export async function ingameAuthGetByUrlIdIfNewAndGetNewUrlId(unsafeInput: IngameAuthGetByUrlIdIfNewInput) {
 	const input = v.parse(ingameAuthGetByUrlIdIfNewSchema, unsafeInput);
 	const session = await db.query.ingameAuth.findFirst({
 		where: (ingameAuth, { eq, and }) => and(eq(ingameAuth.urlId, input.urlId), isMax10MinutesOld()),
