ScoreForge

ScoreCommand

Capability

Temporary Scorers

Hand off the clipboard. Keep the control.

Tournament day means delegating scoring to volunteers, parents, or officials who don't need a full account. ScoreForge's temporary scorer system lets you create short-lived, PIN-authenticated access that's scoped to a single tournament. Scorers get exactly the controls they need and nothing else — sessions expire automatically and can be revoked instantly.

All Capabilities
01

PIN-based authentication

Each temporary scorer gets a 4-digit numeric PIN paired with the tournament's 6-character alphanumeric code. The scorer enters the code and PIN on the mobile app to start a scoring session. PINs are bcrypt-hashed before storage — the plaintext is shown once to the tournament owner and never stored.

4-digit numeric PIN (range 1000–9999), shown once on creation

6-character tournament code from a clean alphabet (confusing characters I, O, 0, 1 removed)

PINs stored as bcrypt hashes with 10 rounds of salt

PIN reset available: generates new PIN and invalidates all existing sessions

02

Scoped session tokens

On successful PIN entry, the scorer receives a 64-character session token that grants access to the tournament's matches for 24 hours. The token is SHA-256 hashed before storage. Every scoring mutation validates the token, checks expiration, and confirms the scorer is still active before processing.

64-character cryptographic session token, hashed before storage

24-hour session expiration from creation time

Token validated on every scoring action — revocation is immediate

Hourly cron job cleans up expired sessions automatically

03

Brute-force protection

Two layers of rate limiting protect the login flow. Per-user limits allow 5 failed PIN attempts per 15-minute window before triggering a 30-minute lockout. Per-code limits cap lookups at 10 per minute to prevent code enumeration. Failed logins return no information about whether the code or PIN was wrong.

5 failed attempts per scorer per 15-minute window

30-minute lockout after exceeding the attempt threshold

10 code lookups per minute to prevent enumeration

Constant-time PIN comparison to prevent timing attacks

04

Scorer lifecycle management

Tournament owners have full control over their scorers. Create scorers with a username and display name, deactivate them to immediately end their access, reactivate them later, or delete them permanently. When a tournament completes, all temporary scorers are automatically deactivated and their sessions deleted.

Create, deactivate, reactivate, and delete scorers from the tournament dashboard

Deactivation immediately invalidates all sessions for that scorer

Automatic deactivation of all scorers when the tournament completes

Username validation: 1–20 characters, lowercase alphanumeric plus underscore and hyphen

05

Dedicated mobile flow

Temporary scorers have their own route group in the mobile app with a purpose-built interface. The home screen shows the tournament name, assigned matches with status filters, and a session expiry warning when less than 2 hours remain. If the session is revoked or expires, an alert fires and the scorer is returned to the login screen.

Dedicated (scorer) route group with scoped navigation

Match list with status filters: all, pending, scheduled, live, completed

Session expiry banner when under 2 hours remain

Automatic detection of session revocation with alert and redirect

Previous

Multi-Format Brackets

Next

Scoreboard Designer

Ready to run your tournament?

ScoreForge gives your operations team the tools to manage brackets, score matches live, and broadcast results — all from one platform.

View All Capabilities