Accounts

A GalShelf account holds your website shelf and lets the desktop app and the website work with the same records. The desktop app works fully without an account.

Two equal ways to sign in#

• Desktop appAvailable in 0.2.8
• WebsiteAvailable

You can sign in with either of these; both lead to the same kind of GalShelf account, and neither needs QQ:

• GalShelf username and password. Usernames are 3–32 characters: lowercase letters, digits, _, . and -, starting with a letter or digit (stored in lowercase). Passwords are 10–128 characters. Passwords are stored only as salted PBKDF2-SHA256 hashes with 600,000 iterations.
• NextMoe (see below).

Sign-in attempts are rate-limited per network address and per username. A website session lasts 14 days; a desktop session lasts 30 days.

Sign in with NextMoe#

• Desktop appAvailable in 0.2.8
• WebsiteAvailable

NextMoe sign-in uses NextMoe's own page (OAuth with PKCE, scopes openid profile). GalShelf reads your NextMoe user ID, display name and avatar; it never sees your NextMoe password. NextMoe tokens are kept only when the server has an encryption key configured, and otherwise are revoked right after sign-in.

The first time you sign in with a NextMoe account that isn't bound yet, you choose within 15 minutes whether to create a new GalShelf account with it or bind it to an account you already have. Nothing is created silently.

Binding and merging accounts#

• Desktop appNot applicable
• WebsiteAvailable

• A password account can bind NextMoe, and a NextMoe account can set a username and password. Afterwards either method opens the same account.
• If you have two GalShelf accounts, you can merge them after checking a preview of both shelves. The merge is refused when both accounts have usernames, both have QQ links, or they are bound to different NextMoe accounts. Nothing is deleted: the merged-away account is kept as a closed record.
• Disconnect NextMoe only revokes the stored NextMoe authorisation; the binding stays. Unbind NextMoe removes the binding and requires the account to have a password.

Signing in on the desktop#

In the desktop app, use Sign in to GalShelf (登录 GalShelf). The NextMoe option opens your normal browser and returns to the app; the app never holds a NextMoe token. The desktop session is stored encrypted for your Windows user (DPAPI).

Signing in or out never uploads or merges your local library. Uploading is a separate, confirmed action: Upload this computer's shelf to this account (把本机书架上传到这个账号). A local library is tied to the first account it was uploaded or synced to, and uploading or syncing it with a different account is refused. In the new interface, Library sync keeps the library and the website in step in both directions. See Sync.

galshelf.com#

• galshelf.com is the GalShelf service and website. The desktop app always uses it, for accounts, sign-in, updates and downloads.
• harihi.com is no longer part of GalShelf. GalShelf is not offered there, not even as a test or backup address.

Earlier account copy#

• Desktop appNot applicable
• WebsiteAvailable

Accounts from GalShelf's former test site (harihi.com) were copied to galshelf.com on 2026-09-29 as a reviewed, non-destructive migration, after backups, a dry run and a conflict report.

• It was a copy; GalShelf no longer runs on the former test site, so use galshelf.com.
• A copied account keeps the password it had before the copy, so you sign in on galshelf.com with that password. Linked identities and shelves were mapped to the account on galshelf.com.
• Sessions were not copied. Sign-in cookies and tokens never move between sites: sign in again on galshelf.com, link Steam again, and reconnect NextMoe or Bangumi when asked.
• Existing galshelf.com accounts were never overwritten. Accounts are never matched by display name or by email. An account that would clash with one already on galshelf.com is held back and not merged until the conflict is resolved.
• Running the copy again does not create duplicates.

Email verification#

• Desktop appNot applicable
• WebsiteIn review candidate
• Email delivery is not configured yet.

Until the service operator connects a mail provider, the account page says "Email delivery is not configured on this site yet, so addresses cannot be added or verified. Your account and sign-in methods are not affected." You keep signing in with your password or NextMoe as before. The desktop app has no email screen.

Once email is available:

• Add an email address on your account page. It stays pending until you open the confirmation link sent to it, which is valid for 24 hours. If you open the link while signed out, the confirmation finishes after you sign in to the same account.
• Changing your address works the same way: the new address is pending until confirmed, the old one stays in use until then, and a notice is sent to the old address. Changing an email never merges accounts.
• Each account can request at most 3 emails per hour and 10 per day, and a newer link replaces older ones.

Password reset#

Once email is available, Forgot your password? on the sign-in page asks for your username or email address. The page always answers the same way, so it can't be used to find out which accounts exist, and requests are limited per network address. If the account has a verified email, a single-use reset link valid for 30 minutes is sent. Setting a new password signs out every website and desktop session of that account. An account without a password gets a notice to sign in with NextMoe instead.

Without a verified email, reset by email is not possible. If your account is bound to NextMoe, you can still sign in with NextMoe.

QQ, Bangumi and VNDB links#

• QQ is only an optional link for galbd group features; see galbd / AstrBot.
• Bangumi can be linked through Bangumi's own authorisation page. Writing changes back to Bangumi is off by default.
• VNDB: paste a token created on VNDB's Applications page. Reading your list needs listread; writing needs listwrite.