Website sign-in, Discord, keys, and releases
Create an account
Open https://extraexecute.fun/register or choose Create account on the sign-in page. Enter a username (3–32 letters, digits, underscores or hyphens), email, and a password of at least 12 characters, then confirm the password. Successful registration creates a normal Free account and signs it in. Client-supplied administrator or subscription fields are not accepted. Existing administrator/subscription records are not modified.
New passwords use a salted scrypt hash. Existing account hashes remain supported; your existing password is not reset by this update. Password changes verify the current password and enforce the new minimum length. Email verification delivery is not configured by this release; registration does not mark an address verified or send a verification message.
The visible application and website name is ExtraExecutor beginning with 2.11.4. Download packages and the primary EXE use that name. Existing Windows application identifiers, the local Potassium data directory, helper payload filenames, MCP environment names, and PotassiumSession scripting API remain compatible. These technical names do not indicate a second account store or a required data migration.
Version 2.11.3 connects the desktop application to https://extraexecute.fun. This sign-in is separate from Roblox and the local vault. No Roblox cookies, vault password, scripts, or private-server links are sent to the website by this feature.
Sign in
The compact startup screen offers Continue in browser, Continue with Discord, and a license-key field. Existing sessions are checked at startup. A network error offers retry; it is not treated as successful authentication.
Continue in browser opens extraexecute.fun. If needed, sign in to the website in the new tab, then return to the approval page. It checks the real database session, not a username or browser login hint. Click Open my workspace to approve that request. The application receives its own session without receiving your website password/cookie. Requests expire after five minutes; browser approval is protected by a per-request value and matched to the signed-in website account.
The integration requires a fresh website sign-in after deployment. Previous compatibility/demo sessions are not trusted for desktop approval. Website password sign-in requires a nonempty matching password; old quick-login/ticket shortcuts are disabled for this flow. Account records are preserved. Protected account/admin API requests use a verified session and CSRF checks; supplied usernames or unsigned cookie payloads are not accepted as authentication. Existing account passwords are not reset by deployment.
For Discord, the application opens your system browser. Authorize the configured Discord application, then return to ExtraExecutor. The account must already be linked in the website dashboard. Its existing Link Discord action now starts verified OAuth. Sign in to the website first, choose that action, and approve Discord. The callback verifies the same website session before linking. A Discord identity already linked to another account is rejected. The website's Discord login uses the verified link to create a real session; it does not accept an arbitrary Discord ID or username as proof.
A fresh Discord access token verifies identity. Desktop requests expire after five minutes and are bound to a native-generated challenge. The application polls every three seconds.
If Discord reports unavailable, the server needs the Discord OAuth Client ID and Client Secret. The registered redirect must be https://extraexecute.fun/api/auth/discord/callback. Bot tokens are not OAuth Client Secrets. Missing configuration produces a visible error, not a simulated login.
For keys, enter a license from the website's redeemkeys database. First desktop activation binds that key to a random local installation ID. The key lifetime is derived from validdays; previously redeemed keys use redeemed_at. Invalid, expired, deleted, or differently bound keys are rejected. Website redemption records are not overwritten by desktop activation. Device-reset administration is not included in this version; do not delete desktop-device-id.txt to try to extend a key.
Discord sign-in establishes identity for an existing linked website account. It does not implement a new subscription checkout or change billing entitlements. License policy and additional paid-feature enforcement remain separate product decisions.
Sessions and local data
Sessions last at most 24 hours and never exceed the key's remaining activation lifetime. Only a token hash is stored server-side. The desktop stores its token in current-user Windows DPAPI as desktop-session.dpapi; frontend responses exclude it. desktop-device-id.txt contains the random installation identifier, not a hardware fingerprint.
Native attachment, profile launching, and script dispatch require a verified desktop session. Successful verification is cached for at most five minutes, bounded by session expiry. Revocations may therefore take up to that interval to affect new operations. This is application authorization, not a claim of unbreakable client-side DRM. It does not close a running Roblox process when a session expires.
Signing out clears the local session and requests server revocation. Your local Roblox vault and saved files remain. If revocation cannot reach the server, the local token is removed and the remote token expires normally. Account Manager still requires its independent vault password.
Downloads and updates
https://extraexecute.fun/download lists Production Setup, Production Portable ZIP, and Standard ZIP with sizes and SHA-256 hashes. Setup aliases return the actual EXE; ZIP aliases return Production Portable.
The release manifest is at /api/releases/latest. The desktop checks it using its compiled version and reports available updates. It does not silently install a download or close itself. Download the new Setup and use the installation guide. SHA-256 checks do not replace a digital signature; this release is unsigned.
English documentation is published at /potassium-docs.
Service endpoints
| Endpoint | Purpose |
|---|
| GET /api/desktop-auth/config | Availability of Discord/key methods |
| POST /api/desktop-auth/key | Key and deviceId sign-in |
| POST /api/desktop-auth/discord/start | Native challenge and deviceId; returns browser URL/request ID |
| POST /api/desktop-auth/browser/start | Native challenge and deviceId; starts website-session approval |
| POST /api/desktop-auth/discord/poll | Request ID and native verifier; returns pending/session |
| GET /api/desktop-auth/session | Verify Bearer session |
| POST /api/desktop-auth/logout | Revoke Bearer session |
| GET /api/releases/latest?version=2.11.3 | Manifest and update comparison |
Do not copy desktop tokens into Roblox scripts or logs. The local MCP token and Roblox session capability are unrelated credentials.
Deployment boundaries
The scoped extension uses only extraexecute.fun's existing extra-web process and projectreal_prod site root. It adds its own authentication tables, module, protected configuration, release directory, and documentation. Existing account records, unrelated sites, nginx/tunnels, bots, and other database services are not replaced. A backup is created before changes.
Build and deployment do not confirm live Discord authorization or real-account/key use. Those require the respective credentials and explicit user interaction.
Key sign-in and recovery
The website sign-in page has Account and License key tabs. License key sign-in accepts a securely generated key already redeemed on its account. Unused keys must first be redeemed while signed in. Short legacy keys are not accepted as passwordless credentials; an administrator can issue a new secure key after checking ownership.
Choose Forgot password or email? to open account recovery:
- For a password reset, enter the activated key and select Verify key.
- Once verified, enter the new password twice (at least 12 characters).
- Save it, then sign in again. Existing website and desktop sessions are revoked.
- For a forgotten email, choose Find email and enter both the username and its activated key. The registered email is shown only after successful verification.
Recovery verification is single-use, browser-bound, and expires after ten minutes. Administrator accounts require password sign-in and cannot be recovered using a license key. License keys used for sign-in/recovery are credentials: keep them private.
Current plans
- Booster: Discord boost eligibility; no advertisement checkpoints.
- Plus: USD 5.55 for 7 days.
- Pro: USD 15.55 for six calendar months on newly issued Pro keys.
- Lifetime: USD 19.99 for lifetime access.
There is no advertised zero-price plan, advertising-based key generation, or cloud-storage allowance in plan descriptions. Existing keys keep their original validity. New accounts can use the website before buying a plan; creating an account does not grant free desktop access. Key generation is an administrator operation; these pages do not simulate successful payment.