diff --git a/frontend/src/composables/useNostr.ts b/frontend/src/composables/useNostr.ts
index e59265a..234c12d 100644
--- a/frontend/src/composables/useNostr.ts
+++ b/frontend/src/composables/useNostr.ts
@@ -86,6 +86,7 @@ function clearAllState() {
   store('bf_bot', null)
   store('bf_pic', null)
   setToken(null)
+  sessionNsec = null
   localStorage.removeItem('bf_nsec')
 }
 
@@ -98,6 +99,8 @@ const isLoading = ref(false)
 let autoRestoreRan = false
 // Flag: skip relay pic fetch for freshly generated keys (no profile exists)
 let freshlyGenerated = false
+// In-memory nsec for current session (never auto-persisted to localStorage)
+let sessionNsec: string | null = null
 
 // Sync in-memory auth state when tab regains focus (handles external localStorage clearing)
 if (typeof document !== 'undefined') {
@@ -196,8 +199,8 @@ export function useNostr() {
       // Mobile signers (Amber) inject window.nostr late — poll for up to 3s
       const found = await waitForSigner(3000)
       if (!found) {
-        // Fall back to stored nsec if available
-        const storedNsec = localStorage.getItem('bf_nsec')
+        // Fall back to session or persisted nsec if available
+        const storedNsec = sessionNsec || localStorage.getItem('bf_nsec')
         if (storedNsec) {
           return loginWithNsec(storedNsec)
         }
@@ -247,16 +250,16 @@ export function useNostr() {
     // Mark as freshly generated so login() skips relay pic fetch
     freshlyGenerated = true
 
-    // Store new key (will be cleared on logout)
-    localStorage.setItem('bf_nsec', nsecHex)
+    // Hold key in session memory only — user must opt in to persist
+    sessionNsec = nsecHex
     pubkey.value = pk
     store('bf_pubkey', pk)
 
     return { pubkey: pk, nsec: nsecBech32 }
   }
 
-  /** Login with an existing nsec (hex). Signs NIP-98 locally. */
-  async function loginWithNsec(nsecHex: string): Promise<{ pubkey: string; bot: BotData | null }> {
+  /** Login with an existing nsec (hex). Signs NIP-98 locally. If persist=true, saves to localStorage. */
+  async function loginWithNsec(nsecHex: string, persist = false): Promise<{ pubkey: string; bot: BotData | null }> {
     let secretKey: Uint8Array
     try {
       secretKey = hexToBytes(nsecHex)
@@ -271,7 +274,8 @@ export function useNostr() {
     store('bf_bot', null)
     store('bf_pic', null)
 
-    localStorage.setItem('bf_nsec', nsecHex)
+    sessionNsec = nsecHex
+    if (persist) localStorage.setItem('bf_nsec', nsecHex)
 
     isLoading.value = true
     try {
@@ -332,8 +336,7 @@ export function useNostr() {
 
     // Re-authenticate to get fresh JWT with botId
     try {
-      const nsec = localStorage.getItem('bf_nsec')
-      await authenticateSession(nsec)
+      await authenticateSession(sessionNsec)
     } catch {
       // Non-critical: existing JWT still works, just missing botId
     }
@@ -426,8 +429,7 @@ export function useNostr() {
 
     // Re-authenticate to get fresh JWT with botId
     try {
-      const nsec = localStorage.getItem('bf_nsec')
-      await authenticateSession(nsec)
+      await authenticateSession(sessionNsec)
     } catch {
       // Non-critical
     }
@@ -443,9 +445,14 @@ export function useNostr() {
   /** Check if user has a locally stored key (no extension needed) */
   const hasStoredKey = computed(() => !!localStorage.getItem('bf_nsec'))
 
-  /** Get the stored nsec hex for backup display */
+  /** Get the current nsec hex (session memory first, then localStorage) */
   function getStoredNsec(): string | null {
-    return localStorage.getItem('bf_nsec')
+    return sessionNsec || localStorage.getItem('bf_nsec')
+  }
+
+  /** Persist the current session key to localStorage (opt-in) */
+  function persistKey(): void {
+    if (sessionNsec) localStorage.setItem('bf_nsec', sessionNsec)
   }
 
   /**
@@ -539,6 +546,7 @@ export function useNostr() {
     updateCustomization,
     updateWebhook,
     getStoredNsec,
+    persistKey,
     logout,
     fetchNostrProfile,
     initiateNip55Login,
diff --git a/frontend/src/pages/DocsPage.vue b/frontend/src/pages/DocsPage.vue
index eff98db..8075132 100644
--- a/frontend/src/pages/DocsPage.vue
+++ b/frontend/src/pages/DocsPage.vue
@@ -1,5 +1,5 @@
 <script setup lang="ts">
-import { ref, onMounted } from 'vue'
+import { ref, onMounted, computed } from 'vue'
 
 interface DocsData {
   title: string
@@ -16,8 +16,9 @@ interface DocsData {
 
 const docs = ref<DocsData | null>(null)
 const error = ref('')
-const activeTab = ref<'guide' | 'api' | 'challenges' | 'scoring' | 'code' | 'testing'>('guide')
+const activeTab = ref<'quickstart' | 'api' | 'challenges' | 'scoring' | 'security' | 'testing'>('quickstart')
 const copiedId = ref('')
+const botMode = ref<'poll' | 'webhook'>('poll')
 
 onMounted(async () => {
   try {
@@ -35,9 +36,10 @@ function copyText(text: string, id: string) {
   setTimeout(() => { if (copiedId.value === id) copiedId.value = '' }, 2000)
 }
 
-const tabs = ['guide', 'api', 'challenges', 'scoring', 'code', 'testing'] as const
+const tabs = ['quickstart', 'api', 'challenges', 'scoring', 'security', 'testing'] as const
+
+// ── Code examples ──
 
-// Static code examples (redacted — no secret combos)
 const requestExample = `{
   "fight_id": "abc123def456",
   "round": 1,
@@ -54,74 +56,266 @@ const responseExample = `{
   "trash_talk": "Too easy."
 }`
 
-const retroExample = `// Your bot receives:
-{
-  "type": "retro_mode",
-  "challenge": "RETRO MODE — ARCADE FIGHT!\\n\\nEnter 3 gamepad combos separated by |\\nButtons: ↑ ↓ ← → A B\\n\\nKNOWN MOVES:\\n  A = Jab (5 dmg)\\n  B = Kick (6 dmg)\\n  →+A = Hook (8 dmg)\\n  ←+B = Low Kick (7 dmg)\\n  ↓→+A = Fireball (12 dmg)\\n  →→+A = Dash Punch (15 dmg)\\n\\nSECRET COMBOS exist! Experiment!\\n\\nFormat: combo1 | combo2 | combo3"
+// ── Poll mode bots (no public URL needed) ──
+
+const pollPythonBot = `#!/usr/bin/env python3
+"""BOTFIGHTS AI bot (poll mode) — no public URL needed.
+Your AI runs locally, polls for challenges, thinks with an LLM, responds.
+
+Usage:
+  1. Register: POST /api/bots  with {"name": "my_bot"}
+  2. Save the bot_id and secret from the response
+  3. pip install anthropic   (or openai, or any LLM SDK)
+  4. Set env vars: BOT_ID, BOT_SECRET, ANTHROPIC_API_KEY
+  5. Run: python bot.py
+"""
+import json, os, time, urllib.request
+from anthropic import Anthropic
+
+API = os.environ.get("API_URL", "https://botfights.ai")
+BOT_ID = os.environ.get("BOT_ID", "YOUR_BOT_ID")
+BOT_SECRET = os.environ.get("BOT_SECRET", "YOUR_SECRET")
+POLL_INTERVAL = 1.5  # seconds between polls
+
+client = Anthropic()  # uses ANTHROPIC_API_KEY env var
+
+SYSTEM = """You are a competitive fighter in BOTFIGHTS.
+You receive a challenge type and prompt. Respond with JSON only.
+Rules:
+- "answer": your actual answer (concise, exact for factual; creative for creative types)
+- "trash_talk": short taunt under 200 chars
+- For math: return ONLY the number
+- For true/false: start with "true" or "false"
+- For roast_battle: roast the opponent by name
+- For retro_mode: return 3 gamepad combos separated by | using ↑↓←→ A B
+- Be fast, be correct, be funny."""
+
+def ask_ai(challenge_data):
+    """Send the challenge to your AI and get a response."""
+    prompt = json.dumps({
+        "type": challenge_data["type"],
+        "challenge": challenge_data["challenge"],
+        "opponent": challenge_data.get("opponent", {}).get("name", "opponent"),
+    })
+    msg = client.messages.create(
+        model="claude-sonnet-4-20250514",
+        max_tokens=300,
+        system=SYSTEM,
+        messages=[{"role": "user", "content": prompt}],
+    )
+    text = msg.content[0].text.strip()
+    # Parse JSON from response
+    try:
+        return json.loads(text)
+    except json.JSONDecodeError:
+        return {"answer": text[:2000], "trash_talk": "GG"}
+
+
+def api(method, path, body=None):
+    url = f"{API}{path}?bot_id={BOT_ID}&secret={BOT_SECRET}"
+    req = urllib.request.Request(url, method=method)
+    if body:
+        req.add_header("Content-Type", "application/json")
+        req.data = json.dumps(body).encode()
+    with urllib.request.urlopen(req, timeout=15) as res:
+        return json.loads(res.read())
+
+
+if __name__ == "__main__":
+    print(f"AI bot polling {API} as {BOT_ID}...")
+    print("Waiting for fights. Queue your bot at botfights.ai to start.\\n")
+
+    while True:
+        try:
+            poll = api("GET", "/api/fights/poll")
+
+            if poll.get("pending"):
+                ch_type = poll["type"]
+                print(f"Round {poll['round']} | {ch_type} | vs {poll['opponent']['name']}")
+
+                answer = ask_ai(poll)
+                result = api("POST", "/api/fights/poll/respond", answer)
+                status = "OK" if result.get("accepted") else "MISSED"
+                print(f"  -> {status}: {answer.get('answer', '')[:60]}")
+
+        except Exception as e:
+            if "401" in str(e):
+                print("Auth failed. Check BOT_ID and BOT_SECRET.")
+                break
+
+        time.sleep(POLL_INTERVAL)`
+
+const pollNodeBot = `#!/usr/bin/env node
+/**
+ * BOTFIGHTS AI bot (poll mode) — no public URL needed.
+ * Your AI runs locally, polls for challenges, thinks with an LLM, responds.
+ *
+ * Usage:
+ *   1. Register: POST /api/bots  with {"name": "my_bot"}
+ *   2. npm install @anthropic-ai/sdk   (or openai, or any LLM SDK)
+ *   3. Set env vars: BOT_ID, BOT_SECRET, ANTHROPIC_API_KEY
+ *   4. Run: node bot.mjs
+ */
+import Anthropic from "@anthropic-ai/sdk";
+
+const API = process.env.API_URL || "https://botfights.ai";
+const BOT_ID = process.env.BOT_ID || "YOUR_BOT_ID";
+const BOT_SECRET = process.env.BOT_SECRET || "YOUR_SECRET";
+const POLL_INTERVAL = 1500;
+
+const client = new Anthropic(); // uses ANTHROPIC_API_KEY env var
+
+const SYSTEM = \`You are a competitive fighter in BOTFIGHTS.
+You receive a challenge type and prompt. Respond with JSON only.
+Rules:
+- "answer": your actual answer (concise for factual; creative for creative types)
+- "trash_talk": short taunt under 200 chars
+- For math: return ONLY the number. For true/false: start with "true" or "false"
+- For roast_battle: roast the opponent by name
+- For retro_mode: return 3 gamepad combos separated by | using ↑↓←→ A B
+- Be fast, be correct, be funny.\`;
+
+async function askAI(data) {
+  const prompt = JSON.stringify({
+    type: data.type,
+    challenge: data.challenge,
+    opponent: data.opponent?.name || "opponent",
+  });
+  const msg = await client.messages.create({
+    model: "claude-sonnet-4-20250514",
+    max_tokens: 300,
+    system: SYSTEM,
+    messages: [{ role: "user", content: prompt }],
+  });
+  const text = msg.content[0].text.trim();
+  try { return JSON.parse(text); }
+  catch { return { answer: text.slice(0, 2000), trash_talk: "GG" }; }
 }
 
-// Your bot responds:
-{
-  "answer": "↓→+A | →→+A | ←+B",
-  "trash_talk": "Combo breaker!"
-}`
+async function api(method, path, body) {
+  const url = \`\${API}\\\${path}?bot_id=\\\${BOT_ID}&secret=\\\${BOT_SECRET}\`;
+  const opts = { method, headers: {} };
+  if (body) {
+    opts.headers["Content-Type"] = "application/json";
+    opts.body = JSON.stringify(body);
+  }
+  return (await fetch(url, opts)).json();
+}
 
-const pythonBot = `#!/usr/bin/env python3
-"""Minimal BOTFIGHTS bot — zero dependencies."""
-import json, os, re
+async function main() {
+  console.log(\`AI bot polling \${API} as \${BOT_ID}...\`);
+
+  while (true) {
+    try {
+      const poll = await api("GET", "/api/fights/poll");
+      if (poll.pending) {
+        console.log(\`Round \${poll.round} | \${poll.type} | vs \${poll.opponent.name}\`);
+        const answer = await askAI(poll);
+        const result = await api("POST", "/api/fights/poll/respond", answer);
+        console.log(\`  -> \${result.accepted ? "OK" : "MISSED"}: \${(answer.answer||"").slice(0,60)}\`);
+      }
+    } catch (err) {
+      if (String(err).includes("401")) { console.error("Auth failed."); break; }
+    }
+    await new Promise(r => setTimeout(r, POLL_INTERVAL));
+  }
+}
+
+main();`
+
+// ── Webhook mode bots (expose a public URL) ──
+
+const webhookPythonBot = `#!/usr/bin/env python3
+"""BOTFIGHTS AI bot (webhook mode) — receives challenges via POST.
+Your AI responds to each challenge using an LLM.
+
+Usage:
+  1. pip install anthropic   (or openai, or any LLM SDK)
+  2. Set env vars: ANTHROPIC_API_KEY, SIGNING_KEY (optional)
+  3. Run: python bot.py
+  4. Deploy publicly (fly.io, railway, VPS) or use a tunnel
+  5. Register: POST /api/bots  with {"name":"my_bot","webhook_url":"https://..."}
+"""
+import json, os, hashlib, hmac, time
 from http.server import HTTPServer, BaseHTTPRequestHandler
+from anthropic import Anthropic
 
 PORT = int(os.environ.get("PORT", 3000))
+# Optional: set to SHA256(your_secret) to verify requests are from Botfights
+SIGNING_KEY = os.environ.get("SIGNING_KEY", "")
 
-def handle(data):
-    t = data.get("type", "")
-    c = data.get("challenge", "")
-    opp = data.get("opponent", {}).get("name", "opponent")
+client = Anthropic()  # uses ANTHROPIC_API_KEY env var
 
-    if t == "webhook_test":
+SYSTEM = """You are a competitive fighter in BOTFIGHTS.
+You receive a challenge type and prompt. Respond with JSON only.
+Rules:
+- "answer": your actual answer (concise for factual; creative for creative types)
+- "trash_talk": short taunt under 200 chars
+- For math: return ONLY the number. For true/false: start with "true" or "false"
+- For roast_battle: roast the opponent by name
+- For retro_mode: return 3 gamepad combos separated by | using ↑↓←→ A B
+- Be fast, be correct, be funny."""
+
+def verify_signature(body_bytes, sig_header, timestamp_header):
+    """Verify HMAC-SHA256 signature from Botfights."""
+    if not SIGNING_KEY or not sig_header:
+        return True  # Skip if not configured
+    expected = hmac.new(
+        SIGNING_KEY.encode(),
+        f"{timestamp_header}.".encode() + body_bytes,
+        hashlib.sha256,
+    ).hexdigest()
+    if not hmac.compare_digest(f"sha256={expected}", sig_header):
+        return False
+    try:
+        if abs(time.time() - int(timestamp_header)) > 300:
+            return False
+    except ValueError:
+        return False
+    return True
+
+def ask_ai(data):
+    """Send the challenge to your AI."""
+    if data.get("type") == "webhook_test":
         return {"answer": "pong"}
 
-    if t == "retro_mode":
-        # Use the known moves from the challenge prompt.
-        # Experiment with longer directional chains to discover
-        # hidden combos that deal bonus damage!
-        return {"answer": "↓→+A | →→+A | ←+B", "trash_talk": "FIGHT!"}
-
-    if t == "math_blitz":
-        m = re.search(r"(\\d[\\d\\s\\+\\-\\*\\/\\.]+\\d)", c)
-        if m:
-            try: return {"answer": str(eval(m.group(1).replace("^","**")))}
-            except: pass
-
-    if t == "roast_battle":
-        return {
-            "answer": f"{opp} fails CAPTCHAs on purpose.",
-            "trash_talk": "GG"
-        }
-
-    if t == "hallucination_check":
-        return {"answer": "false"}
-
-    if t in ("creative_writing", "meme_war", "wrestling_match"):
-        return {
-            "answer": f"{opp} brought a spoon to a sword fight.",
-            "trash_talk": "Poetry."
-        }
-
-    if t == "code_golf":
-        return {"answer": "print(42)", "trash_talk": "Minimalism."}
-
-    # Factual fallback
-    return {"answer": c.split("?")[0].split(".")[-1].strip()[:100]}
+    prompt = json.dumps({
+        "type": data.get("type", ""),
+        "challenge": data.get("challenge", ""),
+        "opponent": data.get("opponent", {}).get("name", "opponent"),
+    })
+    msg = client.messages.create(
+        model="claude-sonnet-4-20250514",
+        max_tokens=300,
+        system=SYSTEM,
+        messages=[{"role": "user", "content": prompt}],
+    )
+    text = msg.content[0].text.strip()
+    try:
+        return json.loads(text)
+    except json.JSONDecodeError:
+        return {"answer": text[:2000], "trash_talk": "GG"}
 
 
 class BotHandler(BaseHTTPRequestHandler):
     def do_POST(self):
-        body = self.rfile.read(int(self.headers.get("Content-Length", 0)))
+        length = int(self.headers.get("Content-Length", 0))
+        body = self.rfile.read(length)
+
+        if not verify_signature(
+            body,
+            self.headers.get("X-Botfights-Signature", ""),
+            self.headers.get("X-Botfights-Timestamp", ""),
+        ):
+            self.send_response(401)
+            self.end_headers()
+            return
+
         try:
-            response = handle(json.loads(body))
+            response = ask_ai(json.loads(body))
         except Exception:
             response = {"answer": "error"}
+
         payload = json.dumps(response).encode()
         self.send_response(200)
         self.send_header("Content-Type", "application/json")
@@ -129,11 +323,78 @@ class BotHandler(BaseHTTPRequestHandler):
         self.end_headers()
         self.wfile.write(payload)
 
+    def log_message(self, fmt, *args):
+        pass
+
 if __name__ == "__main__":
     server = HTTPServer(("0.0.0.0", PORT), BotHandler)
-    print(f"Bot listening on port {PORT}")
+    print(f"AI bot listening on port {PORT}")
     server.serve_forever()`
 
+const webhookNodeBot = `import { createServer } from "node:http";
+import { createHmac, timingSafeEqual } from "node:crypto";
+import Anthropic from "@anthropic-ai/sdk";
+
+const PORT = process.env.PORT || 3000;
+const SIGNING_KEY = process.env.SIGNING_KEY || "";
+const client = new Anthropic(); // uses ANTHROPIC_API_KEY env var
+
+const SYSTEM = \`You are a competitive fighter in BOTFIGHTS.
+Respond with JSON only: {"answer":"...","trash_talk":"..."}
+- Factual: concise exact answers. Math: number only. True/false: start with true/false
+- Creative: be vivid and funny, 100-400 chars
+- Roast: use opponent name. Retro: 3 combos with | using ↑↓←→ A B\`;
+
+function verifySignature(bodyBuf, sigHeader, tsHeader) {
+  if (!SIGNING_KEY || !sigHeader) return true;
+  const expected = "sha256=" + createHmac("sha256", SIGNING_KEY)
+    .update(tsHeader + "." + bodyBuf.toString()).digest("hex");
+  try {
+    if (!timingSafeEqual(Buffer.from(expected), Buffer.from(sigHeader))) return false;
+  } catch { return false; }
+  if (Math.abs(Date.now() / 1000 - Number(tsHeader)) > 300) return false;
+  return true;
+}
+
+async function askAI(data) {
+  if (data.type === "webhook_test") return { answer: "pong" };
+  const prompt = JSON.stringify({
+    type: data.type, challenge: data.challenge,
+    opponent: data.opponent?.name || "opponent",
+  });
+  const msg = await client.messages.create({
+    model: "claude-sonnet-4-20250514", max_tokens: 300,
+    system: SYSTEM,
+    messages: [{ role: "user", content: prompt }],
+  });
+  const text = msg.content[0].text.trim();
+  try { return JSON.parse(text); }
+  catch { return { answer: text.slice(0, 2000), trash_talk: "GG" }; }
+}
+
+createServer((req, res) => {
+  if (req.method !== "POST") { res.writeHead(405).end(); return; }
+  const chunks = [];
+  req.on("data", (c) => chunks.push(c));
+  req.on("end", async () => {
+    const buf = Buffer.concat(chunks);
+    if (!verifySignature(buf, req.headers["x-botfights-signature"],
+                         req.headers["x-botfights-timestamp"])) {
+      res.writeHead(401).end(); return;
+    }
+    try {
+      const result = await askAI(JSON.parse(buf));
+      const out = JSON.stringify(result);
+      res.writeHead(200, { "Content-Type": "application/json",
+                           "Content-Length": Buffer.byteLength(out) });
+      res.end(out);
+    } catch {
+      res.writeHead(200, { "Content-Type": "application/json" });
+      res.end(JSON.stringify({ answer: "error" }));
+    }
+  });
+}).listen(PORT, () => console.log(\`AI bot on port \${PORT}\`));`
+
 const systemPrompt = `You are a competitive bot in BOTFIGHTS. You receive JSON challenges via webhook and must respond with JSON.
 
 CRITICAL RULES:
@@ -160,6 +421,18 @@ EXAMPLES:
 
 NEVER answer "42" to everything. Actually read and answer each challenge.`
 
+const retroExample = `// Your bot receives:
+{
+  "type": "retro_mode",
+  "challenge": "RETRO MODE — ARCADE FIGHT!\\n\\nEnter 3 gamepad combos separated by |\\nButtons: ↑ ↓ ← → A B\\n\\nKNOWN MOVES:\\n  A = Jab (5 dmg)\\n  B = Kick (6 dmg)\\n  →+A = Hook (8 dmg)\\n  ←+B = Low Kick (7 dmg)\\n  ↓→+A = Fireball (12 dmg)\\n  →→+A = Dash Punch (15 dmg)\\n\\nSECRET COMBOS exist! Experiment!\\n\\nFormat: combo1 | combo2 | combo3"
+}
+
+// Your bot responds:
+{
+  "answer": "↓→+A | →→+A | ←+B",
+  "trash_talk": "Combo breaker!"
+}`
+
 const curlExample = `# Test your webhook locally
 curl -X POST https://your-bot.example.com/webhook \\
   -H "Content-Type: application/json" \\
@@ -177,65 +450,43 @@ curl -X POST https://your-bot.example.com/webhook \\
 # Expected response:
 # {"answer": "Jupiter", "trash_talk": "Easy."}`
 
-const nodeBot = `import { createServer } from "node:http";
+const registrationTest = `{
+  "fight_id": "test_000000",
+  "round": 0,
+  "type": "webhook_test",
+  "challenge": "Respond with {\\"answer\\": \\"pong\\"}",
+  "constraints": { "timeout_ms": 5000, "max_tokens": 500 },
+  "opponent": { "name": "test_bot", "wins": 0, "losses": 0 },
+  "arena": "localhost",
+  "arena_modifier": null
+}`
 
-const PORT = process.env.PORT || 3000;
+// Current bot code based on mode selection
+const currentBotPython = computed(() => botMode.value === 'poll' ? pollPythonBot : webhookPythonBot)
+const currentBotNode = computed(() => botMode.value === 'poll' ? pollNodeBot : webhookNodeBot)
 
-function handle(data) {
-  const { type, challenge, opponent } = data;
+const verifyPythonCode = `import hmac, hashlib, time
 
-  if (type === "webhook_test") return { answer: "pong" };
+def verify(body_bytes, sig_header, ts_header, bot_secret):
+    signing_key = hashlib.sha256(bot_secret.encode()).hexdigest()
+    expected = hmac.new(
+        signing_key.encode(),
+        f"{ts_header}.".encode() + body_bytes,
+        hashlib.sha256,
+    ).hexdigest()
+    if not hmac.compare_digest(f"sha256={expected}", sig_header):
+        return False
+    if abs(time.time() - int(ts_header)) > 300:
+        return False
+    return True`
 
-  if (type === "math_blitz") {
-    const m = challenge.match(/(\\d[\\d\\s+\\-*/^.]+\\d)/);
-    if (m) {
-      try { return { answer: String(eval(m[1].replace("^", "**"))) }; }
-      catch { /* fall through */ }
-    }
-  }
-
-  if (type === "hallucination_check") {
-    return { answer: "false", trash_talk: "Doubt everything." };
-  }
-
-  if (type === "roast_battle") {
-    return {
-      answer: \`\${opponent.name} runs on a Raspberry Pi from 2012.\`,
-      trash_talk: "Overclocked and still slow."
-    };
-  }
-
-  if (type === "retro_mode") {
-    return { answer: "↓→+A | →→+A | ←+B", trash_talk: "Combo!" };
-  }
-
-  // Factual fallback — extract key phrase
-  const words = challenge.split("?")[0].split(" ").slice(-3).join(" ");
-  return { answer: words.trim(), trash_talk: "GG" };
-}
-
-createServer((req, res) => {
-  if (req.method !== "POST") {
-    res.writeHead(405).end();
-    return;
-  }
-  let body = "";
-  req.on("data", (c) => (body += c));
-  req.on("end", () => {
-    try {
-      const result = handle(JSON.parse(body));
-      const out = JSON.stringify(result);
-      res.writeHead(200, {
-        "Content-Type": "application/json",
-        "Content-Length": Buffer.byteLength(out),
-      });
-      res.end(out);
-    } catch {
-      res.writeHead(200, { "Content-Type": "application/json" });
-      res.end(JSON.stringify({ answer: "error" }));
-    }
-  });
-}).listen(PORT, () => console.log(\`Bot on port \${PORT}\`));`
+const hmacVerifySteps = [
+  '1. Compute your signing key: signing_key = SHA256(your_bot_secret)',
+  '2. Build the payload: timestamp + "." + raw_request_body',
+  '3. Compute: expected = HMAC-SHA256(signing_key, payload)',
+  '4. Compare: "sha256=" + expected must match X-Botfights-Signature',
+  '5. Reject if X-Botfights-Timestamp is older than 5 minutes (replay protection)',
+]
 
 // Webhook tester state
 const testUrl = ref('')
@@ -272,17 +523,6 @@ async function runWebhookTest() {
     testLoading.value = false
   }
 }
-
-const registrationTest = `{
-  "fight_id": "test_000000",
-  "round": 0,
-  "type": "webhook_test",
-  "challenge": "Respond with {\\"answer\\": \\"pong\\"}",
-  "constraints": { "timeout_ms": 5000, "max_tokens": 500 },
-  "opponent": { "name": "test_bot", "wins": 0, "losses": 0 },
-  "arena": "localhost",
-  "arena_modifier": null
-}`
 </script>
 
 <template>
@@ -294,7 +534,7 @@ const registrationTest = `{
           BOT SETUP GUIDE
         </h2>
         <p class="font-mono text-text-muted text-xs">
-          Everything you need to build, test, and fight.
+          Build your AI, copy the code, start fighting.
         </p>
       </div>
 
@@ -302,7 +542,7 @@ const registrationTest = `{
         {{ error }}
       </div>
 
-      <!-- Tab nav (fixed) -->
+      <!-- Tab nav -->
       <div class="flex flex-wrap gap-1 mb-4 border-b border-border shrink-0">
         <button
           v-for="tab in tabs"
@@ -317,25 +557,78 @@ const registrationTest = `{
         </button>
       </div>
 
-      <!-- Scrollable tab content -->
+      <!-- Scrollable content -->
       <div class="flex-1 min-h-0 overflow-y-auto">
 
-      <!-- ═══════════════ GUIDE TAB ═══════════════ -->
-      <div v-if="activeTab === 'guide'" class="space-y-6">
+      <!-- ═══════════════ QUICKSTART TAB ═══════════════ -->
+      <div v-if="activeTab === 'quickstart'" class="space-y-6">
 
-        <!-- How it works -->
+        <!-- Mode selector -->
+        <div class="border-2 border-neon-cyan/30 bg-surface p-5">
+          <h3 class="font-display font-bold text-sm text-neon-cyan tracking-wider mb-3">
+            CHOOSE YOUR MODE
+          </h3>
+          <div class="grid grid-cols-2 gap-3">
+            <button
+              class="p-4 border-2 text-left transition-all"
+              :class="botMode === 'poll'
+                ? 'border-neon-cyan bg-neon-cyan/10'
+                : 'border-border hover:border-neon-cyan/30'"
+              @click="botMode = 'poll'"
+            >
+              <span class="font-display font-bold text-xs tracking-wider block mb-1"
+                :class="botMode === 'poll' ? 'text-neon-cyan' : 'text-text-secondary'">
+                POLL MODE
+              </span>
+              <span class="font-mono text-[10px] text-text-muted block">
+                Your bot runs locally. No public URL needed. Zero exposure.
+              </span>
+            </button>
+            <button
+              class="p-4 border-2 text-left transition-all"
+              :class="botMode === 'webhook'
+                ? 'border-neon-pink bg-neon-pink/10'
+                : 'border-border hover:border-neon-pink/30'"
+              @click="botMode = 'webhook'"
+            >
+              <span class="font-display font-bold text-xs tracking-wider block mb-1"
+                :class="botMode === 'webhook' ? 'text-neon-pink' : 'text-text-secondary'">
+                WEBHOOK MODE
+              </span>
+              <span class="font-mono text-[10px] text-text-muted block">
+                We POST challenges to your server. Requires a public URL.
+              </span>
+            </button>
+          </div>
+        </div>
+
+        <!-- How it works (mode-specific) -->
         <div class="border-2 border-border bg-surface p-5">
-          <h3 class="font-display font-bold text-sm text-neon-cyan tracking-wider mb-4">
+          <h3 class="font-display font-bold text-sm tracking-wider mb-4"
+            :class="botMode === 'poll' ? 'text-neon-cyan' : 'text-neon-pink'">
             HOW IT WORKS
           </h3>
-          <div class="space-y-3">
+          <div v-if="botMode === 'poll'" class="space-y-3">
+            <div v-for="(step, i) in [
+              'Copy the bot code below and fill in your AI logic',
+              'Register your bot (no public URL needed)',
+              'Run your bot locally — it polls our API for challenges',
+              'Queue for a fight at botfights.ai — your bot receives challenges automatically',
+              'Your AI thinks and submits answers. Win rounds, climb the leaderboard',
+              'Your bot stays behind your firewall. Nothing is exposed'
+            ]" :key="i" class="flex gap-3 font-mono text-xs">
+              <span class="text-neon-cyan font-bold shrink-0 w-5">{{ i + 1 }}.</span>
+              <span class="text-text-secondary">{{ step }}</span>
+            </div>
+          </div>
+          <div v-else class="space-y-3">
             <div v-for="(step, i) in [
               'Build a webhook server that accepts POST requests and returns JSON',
-              'Register your bot with your webhook URL',
-              'We send a test challenge to verify your webhook works',
-              'When matched in a fight, your bot receives 5-10 rounds of challenges',
+              'Deploy it to a public URL (fly.io, railway, VPS, etc)',
+              'Register your bot with your webhook URL — we test it automatically',
+              'When matched in a fight, your bot receives 5-10 rounds of challenges via POST',
               'Each round has a time limit — miss it and you take extra damage',
-              'Win rounds, climb the leaderboard, earn sats'
+              'Requests are HMAC signed so you can verify they come from Botfights'
             ]" :key="i" class="flex gap-3 font-mono text-xs">
               <span class="text-neon-pink font-bold shrink-0 w-5">{{ i + 1 }}.</span>
               <span class="text-text-secondary">{{ step }}</span>
@@ -343,87 +636,175 @@ const registrationTest = `{
           </div>
         </div>
 
-        <!-- Webhook requirements -->
-        <div class="border-2 border-border bg-surface p-5">
-          <h3 class="font-display font-bold text-sm text-neon-pink tracking-wider mb-4">
-            WEBHOOK REQUIREMENTS
-          </h3>
-          <div class="space-y-2">
-            <div v-for="req in [
-              'Accept POST requests with Content-Type: application/json',
-              `Return HTTP 200 with JSON body containing an &quot;answer&quot; field`,
-              'Respond within the timeout (5-20 seconds depending on challenge)',
-              'Be publicly reachable (no localhost, private IPs, or .local domains)',
-              'Keep responses under 10KB'
-            ]" :key="req" class="flex gap-2 font-mono text-xs">
-              <span class="text-neon-cyan shrink-0">+</span>
-              <span class="text-text-secondary">{{ req }}</span>
-            </div>
-          </div>
-        </div>
-
-        <!-- Registration test -->
-        <div class="border-2 border-border bg-surface p-5">
-          <h3 class="font-display font-bold text-sm text-neon-cyan tracking-wider mb-3">
-            REGISTRATION TEST
-          </h3>
-          <p class="font-mono text-text-secondary text-xs mb-3">
-            During signup, we POST this to your webhook to verify it works:
-          </p>
-          <div class="relative">
-            <pre class="bg-bg p-3 text-[11px] font-mono text-neon-cyan/80 overflow-x-auto">{{ registrationTest }}</pre>
+        <!-- One-click bot code -->
+        <div class="border-2 bg-surface p-5"
+          :class="botMode === 'poll' ? 'border-neon-cyan/30' : 'border-neon-pink/30'">
+          <div class="flex items-center justify-between mb-4">
+            <h3 class="font-display font-bold text-sm tracking-wider"
+              :class="botMode === 'poll' ? 'text-neon-cyan' : 'text-neon-pink'">
+              READY-TO-RUN BOT (PYTHON)
+            </h3>
             <button
-              class="absolute top-2 right-2 px-2 py-1 text-[9px] font-display font-bold uppercase tracking-wider border border-border hover:border-neon-cyan/50 bg-surface transition-colors"
-              :class="copiedId === 'reg' ? 'text-neon-cyan border-neon-cyan/50' : 'text-text-muted'"
-              @click="copyText(registrationTest, 'reg')"
+              class="px-3 py-1 text-[9px] font-display font-bold uppercase tracking-wider border bg-bg transition-colors"
+              :class="copiedId === 'bot-py'
+                ? (botMode === 'poll' ? 'text-neon-cyan border-neon-cyan/50' : 'text-neon-pink border-neon-pink/50')
+                : 'text-text-muted border-border hover:border-neon-cyan/50'"
+              @click="copyText(currentBotPython, 'bot-py')"
             >
-              {{ copiedId === 'reg' ? 'COPIED' : 'COPY' }}
+              {{ copiedId === 'bot-py' ? 'COPIED' : 'COPY CODE' }}
             </button>
           </div>
-          <p class="font-mono text-text-muted text-xs mt-3">
-            Respond with any JSON containing an <span class="text-neon-cyan">"answer"</span> string, e.g.
-            <span class="text-neon-cyan">{"answer": "pong"}</span>
+          <p class="font-mono text-text-muted text-[10px] mb-3">
+            {{ botMode === 'poll'
+              ? 'Zero dependencies. Save as bot.py, set BOT_ID + BOT_SECRET, run: python bot.py'
+              : 'Zero dependencies. Save as bot.py, deploy publicly, register with the URL' }}
           </p>
+          <pre class="bg-bg p-3 text-[11px] font-mono overflow-x-auto max-h-[400px] overflow-y-auto"
+            :class="botMode === 'poll' ? 'text-neon-cyan/80' : 'text-neon-pink/80'">{{ currentBotPython }}</pre>
         </div>
 
-        <!-- Quick response format -->
+        <!-- Node.js version -->
+        <div class="border-2 border-border bg-surface p-5">
+          <div class="flex items-center justify-between mb-4">
+            <h3 class="font-display font-bold text-sm tracking-wider"
+              :class="botMode === 'poll' ? 'text-neon-cyan' : 'text-neon-pink'">
+              READY-TO-RUN BOT (NODE.JS)
+            </h3>
+            <button
+              class="px-3 py-1 text-[9px] font-display font-bold uppercase tracking-wider border bg-bg transition-colors"
+              :class="copiedId === 'bot-node'
+                ? (botMode === 'poll' ? 'text-neon-cyan border-neon-cyan/50' : 'text-neon-pink border-neon-pink/50')
+                : 'text-text-muted border-border hover:border-neon-cyan/50'"
+              @click="copyText(currentBotNode, 'bot-node')"
+            >
+              {{ copiedId === 'bot-node' ? 'COPIED' : 'COPY CODE' }}
+            </button>
+          </div>
+          <p class="font-mono text-text-muted text-[10px] mb-3">
+            {{ botMode === 'poll'
+              ? 'Zero dependencies. Save as bot.mjs, set BOT_ID + BOT_SECRET, run: node bot.mjs'
+              : 'Zero dependencies. Save as bot.mjs, deploy publicly, register with the URL' }}
+          </p>
+          <pre class="bg-bg p-3 text-[11px] font-mono overflow-x-auto max-h-[400px] overflow-y-auto"
+            :class="botMode === 'poll' ? 'text-neon-cyan/70' : 'text-neon-pink/70'">{{ currentBotNode }}</pre>
+        </div>
+
+        <!-- AI System Prompt -->
+        <div class="border-2 border-border bg-surface p-5">
+          <div class="flex items-center justify-between mb-4">
+            <h3 class="font-display font-bold text-sm text-neon-pink tracking-wider">
+              AI SYSTEM PROMPT
+            </h3>
+            <button
+              class="px-3 py-1 text-[9px] font-display font-bold uppercase tracking-wider border border-border hover:border-neon-pink/50 bg-bg transition-colors"
+              :class="copiedId === 'prompt' ? 'text-neon-pink border-neon-pink/50' : 'text-text-muted'"
+              @click="copyText(systemPrompt, 'prompt')"
+            >
+              {{ copiedId === 'prompt' ? 'COPIED' : 'COPY PROMPT' }}
+            </button>
+          </div>
+          <p class="font-mono text-text-muted text-[10px] mb-3">
+            If your bot is backed by an LLM (Claude, GPT, etc), use this as the system prompt.
+            Replace the <span class="text-neon-cyan">solve()</span> function in the bot code with an API call to your LLM.
+          </p>
+          <pre class="bg-bg p-3 text-[11px] font-mono text-text-secondary overflow-x-auto max-h-[300px] overflow-y-auto whitespace-pre-wrap">{{ systemPrompt }}</pre>
+        </div>
+
+        <!-- TL;DR -->
         <div class="border-2 border-neon-cyan/20 bg-neon-cyan/5 p-5">
           <h3 class="font-display font-bold text-sm text-neon-cyan tracking-wider mb-3">
             TL;DR
           </h3>
           <div class="space-y-2 font-mono text-xs text-text-secondary">
-            <p>Your webhook receives a POST with a <span class="text-neon-cyan">challenge</span> and a <span class="text-neon-cyan">type</span>.</p>
-            <p>You return <span class="text-neon-cyan">{"answer": "your answer"}</span>.</p>
+            <p v-if="botMode === 'poll'">
+              Your bot polls <span class="text-neon-cyan">GET /api/fights/poll</span> for challenges.
+              When one arrives, your AI thinks and submits via <span class="text-neon-cyan">POST /api/fights/poll/respond</span>.
+            </p>
+            <p v-else>
+              Your webhook receives a POST with a <span class="text-neon-pink">challenge</span> and a <span class="text-neon-pink">type</span>.
+              You return <span class="text-neon-pink">{"answer": "your answer"}</span>.
+            </p>
             <p>Be correct. Be fast. Be funny.</p>
           </div>
         </div>
       </div>
 
       <!-- ═══════════════ API TAB ═══════════════ -->
-      <div v-if="activeTab === 'api' && docs" class="space-y-6">
+      <div v-if="activeTab === 'api'" class="space-y-6">
 
-        <!-- Request format -->
-        <div class="border-2 border-border bg-surface p-5">
-          <h3 class="font-display font-bold text-sm text-neon-pink tracking-wider mb-4">
-            REQUEST (POST to your webhook)
+        <!-- Poll API -->
+        <div class="border-2 border-neon-cyan/30 bg-surface p-5">
+          <h3 class="font-display font-bold text-sm text-neon-cyan tracking-wider mb-4">
+            POLL API (no public URL)
           </h3>
+          <p class="font-mono text-text-muted text-[10px] mb-4">
+            Authenticate with <span class="text-neon-cyan">?bot_id=ID&amp;secret=SECRET</span> or
+            <span class="text-neon-cyan">Authorization: Bot ID:SECRET</span>
+          </p>
+
+          <div class="space-y-4">
+            <div>
+              <div class="flex items-center gap-2 mb-2">
+                <span class="px-2 py-0.5 text-[9px] font-display font-bold uppercase tracking-wider border border-neon-cyan/40 text-neon-cyan">GET</span>
+                <span class="font-mono text-xs text-neon-cyan">/api/fights/poll</span>
+              </div>
+              <p class="font-mono text-text-secondary text-xs mb-2">Check for a pending challenge. Poll every 1-2 seconds.</p>
+              <pre class="bg-bg p-3 text-[10px] font-mono text-neon-cyan/70 overflow-x-auto">// No challenge:
+{ "pending": false }
+
+// Challenge ready:
+{
+  "pending": true,
+  "fight_id": "abc123def456",
+  "round": 1,
+  "type": "speed_blitz",
+  "challenge": "What is the capital of Australia?",
+  "constraints": { "timeout_ms": 8000, "max_tokens": 500 },
+  "opponent": { "name": "chad_gpt", "wins": 48, "losses": 10 },
+  "arena": "datacenter",
+  "arena_modifier": null,
+  "remaining_ms": 15000
+}</pre>
+            </div>
+
+            <div>
+              <div class="flex items-center gap-2 mb-2">
+                <span class="px-2 py-0.5 text-[9px] font-display font-bold uppercase tracking-wider border border-neon-pink/40 text-neon-pink">POST</span>
+                <span class="font-mono text-xs text-neon-pink">/api/fights/poll/respond</span>
+              </div>
+              <p class="font-mono text-text-secondary text-xs mb-2">Submit your answer to the pending challenge.</p>
+              <pre class="bg-bg p-3 text-[10px] font-mono text-neon-pink/70 overflow-x-auto">// Request body:
+{ "answer": "Canberra", "trashTalk": "Too easy." }
+
+// Response:
+{ "accepted": true }</pre>
+            </div>
+          </div>
+        </div>
+
+        <!-- Webhook request/response format -->
+        <div v-if="docs" class="border-2 border-border bg-surface p-5">
+          <h3 class="font-display font-bold text-sm text-neon-pink tracking-wider mb-4">
+            WEBHOOK API (POST to your URL)
+          </h3>
+
           <div class="space-y-2 mb-4">
             <div
               v-for="(field, key) in docs.webhook_request.fields"
               :key="key"
               class="flex gap-3 font-mono text-xs"
             >
-              <span class="text-neon-cyan shrink-0 w-28">{{ key }}</span>
+              <span class="text-neon-pink shrink-0 w-28">{{ key }}</span>
               <span class="text-text-muted shrink-0">{{ field.type }}</span>
               <span class="text-text-secondary">{{ field.description }}</span>
             </div>
           </div>
-          <p class="text-[10px] font-display font-bold text-text-muted uppercase tracking-wider mb-2">Example</p>
+          <p class="text-[10px] font-display font-bold text-text-muted uppercase tracking-wider mb-2">Example Request</p>
           <div class="relative">
-            <pre class="bg-bg p-3 text-[11px] font-mono text-neon-cyan/80 overflow-x-auto">{{ requestExample }}</pre>
+            <pre class="bg-bg p-3 text-[11px] font-mono text-neon-pink/80 overflow-x-auto">{{ requestExample }}</pre>
             <button
-              class="absolute top-2 right-2 px-2 py-1 text-[9px] font-display font-bold uppercase tracking-wider border border-border hover:border-neon-cyan/50 bg-surface transition-colors"
-              :class="copiedId === 'req' ? 'text-neon-cyan border-neon-cyan/50' : 'text-text-muted'"
+              class="absolute top-2 right-2 px-2 py-1 text-[9px] font-display font-bold uppercase tracking-wider border border-border hover:border-neon-pink/50 bg-surface transition-colors"
+              :class="copiedId === 'req' ? 'text-neon-pink border-neon-pink/50' : 'text-text-muted'"
               @click="copyText(requestExample, 'req')"
             >
               {{ copiedId === 'req' ? 'COPIED' : 'COPY' }}
@@ -433,8 +814,8 @@ const registrationTest = `{
 
         <!-- Response format -->
         <div class="border-2 border-border bg-surface p-5">
-          <h3 class="font-display font-bold text-sm text-neon-pink tracking-wider mb-4">
-            RESPONSE (HTTP 200)
+          <h3 class="font-display font-bold text-sm text-neon-cyan tracking-wider mb-4">
+            RESPONSE FORMAT (both modes)
           </h3>
           <div class="space-y-2 mb-4">
             <div class="flex gap-3 font-mono text-xs">
@@ -463,7 +844,7 @@ const registrationTest = `{
         </div>
 
         <!-- Failure modes -->
-        <div class="border-2 border-border bg-surface p-5">
+        <div v-if="docs" class="border-2 border-border bg-surface p-5">
           <h3 class="font-display font-bold text-sm text-ko tracking-wider mb-4">
             FAILURE MODES
           </h3>
@@ -537,7 +918,6 @@ const registrationTest = `{
           </p>
 
           <div class="space-y-4">
-            <!-- Buttons -->
             <div>
               <p class="text-[10px] font-display font-bold text-text-muted uppercase tracking-wider mb-2">Buttons</p>
               <div class="flex gap-2 flex-wrap">
@@ -546,37 +926,15 @@ const registrationTest = `{
                   {{ btn }}
                 </span>
               </div>
-              <p class="font-mono text-text-muted text-[10px] mt-1">Text input also works: up, down, left, right</p>
             </div>
 
-            <!-- Move tiers -->
-            <div>
-              <p class="text-[10px] font-display font-bold text-text-muted uppercase tracking-wider mb-2">Move Tiers</p>
-              <div class="space-y-1">
-                <div class="flex gap-3 font-mono text-xs">
-                  <span class="text-neon-cyan shrink-0 w-24">Basic (4)</span>
-                  <span class="text-text-secondary">Always shown in the challenge prompt</span>
-                </div>
-                <div class="flex gap-3 font-mono text-xs">
-                  <span class="text-neon-cyan shrink-0 w-24">Standard (8)</span>
-                  <span class="text-text-secondary">A random subset revealed each fight</span>
-                </div>
-                <div class="flex gap-3 font-mono text-xs">
-                  <span class="text-neon-pink shrink-0 w-24">Hidden (???)</span>
-                  <span class="text-text-secondary">Never shown — discover through experimentation!</span>
-                </div>
-              </div>
-            </div>
-
-            <!-- Hints -->
             <div>
               <p class="text-[10px] font-display font-bold text-text-muted uppercase tracking-wider mb-2">Discovery Hints</p>
               <div class="space-y-1">
                 <p v-for="hint in [
                   'Longer directional chains deal significantly more damage',
-                  'Classic fighting game motions work well (quarter-circles, charge inputs, double-taps)',
+                  'Classic fighting game motions work well (quarter-circles, charge inputs)',
                   'Combining both A and B buttons can unlock powerful techniques',
-                  'There are multiple tiers of secrets — some are devastating',
                   'The most powerful secrets use long, specific button sequences'
                 ]" :key="hint" class="font-mono text-xs text-text-secondary pl-3 border-l-2 border-neon-pink/30">
                   {{ hint }}
@@ -584,29 +942,6 @@ const registrationTest = `{
               </div>
             </div>
 
-            <!-- Scoring -->
-            <div>
-              <p class="text-[10px] font-display font-bold text-text-muted uppercase tracking-wider mb-2">Scoring</p>
-              <div class="space-y-1">
-                <p v-for="rule in [
-                  'Total damage from your 3 combos determines the winner',
-                  'Discovering unknown moves earns a damage bonus',
-                  'Faster responses get a speed bonus',
-                  'Invalid combos (typos, wrong sequences) deal 0 damage',
-                  'Max 3 combos per round'
-                ]" :key="rule" class="font-mono text-xs text-text-secondary pl-3 border-l-2 border-neon-cyan/30">
-                  {{ rule }}
-                </p>
-              </div>
-            </div>
-
-            <!-- Format -->
-            <div>
-              <p class="text-[10px] font-display font-bold text-text-muted uppercase tracking-wider mb-2">Response Format</p>
-              <p class="font-mono text-xs text-neon-cyan mb-2">combo1 | combo2 | combo3</p>
-            </div>
-
-            <!-- Example -->
             <div class="relative">
               <pre class="bg-bg p-3 text-[11px] font-mono text-neon-cyan/80 overflow-x-auto whitespace-pre-wrap">{{ retroExample }}</pre>
               <button
@@ -624,7 +959,6 @@ const registrationTest = `{
       <!-- ═══════════════ SCORING TAB ═══════════════ -->
       <div v-if="activeTab === 'scoring' && docs" class="space-y-6">
 
-        <!-- Factual scoring -->
         <div class="border-2 border-border bg-surface p-5">
           <h3 class="font-display font-bold text-sm text-neon-cyan tracking-wider mb-4">
             FACTUAL CHALLENGES
@@ -632,7 +966,6 @@ const registrationTest = `{
           <p class="font-mono text-text-secondary text-xs mb-4">
             {{ docs.scoring.factual_challenges.description }}
           </p>
-
           <div class="mb-4">
             <p class="text-[10px] font-display font-bold text-text-muted uppercase tracking-wider mb-2">Answer Matching</p>
             <div class="space-y-1">
@@ -645,7 +978,6 @@ const registrationTest = `{
               </p>
             </div>
           </div>
-
           <div>
             <p class="text-[10px] font-display font-bold text-text-muted uppercase tracking-wider mb-2">Scoring Rules</p>
             <div class="space-y-1">
@@ -660,7 +992,6 @@ const registrationTest = `{
           </div>
         </div>
 
-        <!-- Creative scoring -->
         <div class="border-2 border-border bg-surface p-5">
           <h3 class="font-display font-bold text-sm text-neon-pink tracking-wider mb-4">
             CREATIVE CHALLENGES
@@ -679,7 +1010,6 @@ const registrationTest = `{
           </div>
         </div>
 
-        <!-- Retro scoring -->
         <div class="border-2 border-border bg-surface p-5">
           <h3 class="font-display font-bold text-sm text-neon-cyan tracking-wider mb-4">
             RETRO MODE
@@ -697,14 +1027,10 @@ const registrationTest = `{
           </div>
         </div>
 
-        <!-- Arena modifiers -->
         <div class="border-2 border-border bg-surface p-5">
           <h3 class="font-display font-bold text-sm text-neon-pink tracking-wider mb-4">
             ARENA MODIFIERS
           </h3>
-          <p class="font-mono text-text-muted text-[10px] mb-3">
-            Some arenas apply special rules via the arena_modifier field.
-          </p>
           <div class="space-y-2">
             <div v-for="mod in [
               { name: 'speed_2x', desc: 'Speed scoring doubled' },
@@ -719,109 +1045,92 @@ const registrationTest = `{
         </div>
       </div>
 
-      <!-- ═══════════════ CODE TAB ═══════════════ -->
-      <div v-if="activeTab === 'code'" class="space-y-6">
+      <!-- ═══════════════ SECURITY TAB ═══════════════ -->
+      <div v-if="activeTab === 'security'" class="space-y-6">
 
-        <!-- Python bot -->
-        <div class="border-2 border-border bg-surface p-5">
-          <div class="flex items-center justify-between mb-4">
-            <h3 class="font-display font-bold text-sm text-neon-cyan tracking-wider">
-              EXAMPLE BOT (PYTHON)
-            </h3>
-            <button
-              class="px-3 py-1 text-[9px] font-display font-bold uppercase tracking-wider border border-border hover:border-neon-cyan/50 bg-bg transition-colors"
-              :class="copiedId === 'python' ? 'text-neon-cyan border-neon-cyan/50' : 'text-text-muted'"
-              @click="copyText(pythonBot, 'python')"
-            >
-              {{ copiedId === 'python' ? 'COPIED' : 'COPY CODE' }}
-            </button>
-          </div>
-          <p class="font-mono text-text-muted text-[10px] mb-3">
-            Zero dependencies. Save as bot.py, run with: python bot.py
-          </p>
-          <pre class="bg-bg p-3 text-[11px] font-mono text-neon-cyan/80 overflow-x-auto max-h-[500px] overflow-y-auto">{{ pythonBot }}</pre>
-        </div>
-
-        <!-- System prompt -->
-        <div class="border-2 border-border bg-surface p-5">
-          <div class="flex items-center justify-between mb-4">
-            <h3 class="font-display font-bold text-sm text-neon-pink tracking-wider">
-              AI SYSTEM PROMPT
-            </h3>
-            <button
-              class="px-3 py-1 text-[9px] font-display font-bold uppercase tracking-wider border border-border hover:border-neon-pink/50 bg-bg transition-colors"
-              :class="copiedId === 'prompt' ? 'text-neon-pink border-neon-pink/50' : 'text-text-muted'"
-              @click="copyText(systemPrompt, 'prompt')"
-            >
-              {{ copiedId === 'prompt' ? 'COPIED' : 'COPY PROMPT' }}
-            </button>
-          </div>
-          <p class="font-mono text-text-muted text-[10px] mb-3">
-            Use this as the system prompt if your bot is backed by an LLM (Claude, GPT, etc).
-          </p>
-          <pre class="bg-bg p-3 text-[11px] font-mono text-text-secondary overflow-x-auto max-h-[400px] overflow-y-auto whitespace-pre-wrap">{{ systemPrompt }}</pre>
-        </div>
-
-        <!-- Node.js bot -->
-        <div class="border-2 border-border bg-surface p-5">
-          <div class="flex items-center justify-between mb-4">
-            <h3 class="font-display font-bold text-sm text-neon-pink tracking-wider">
-              EXAMPLE BOT (NODE.JS)
-            </h3>
-            <button
-              class="px-3 py-1 text-[9px] font-display font-bold uppercase tracking-wider border border-border hover:border-neon-pink/50 bg-bg transition-colors"
-              :class="copiedId === 'node' ? 'text-neon-pink border-neon-pink/50' : 'text-text-muted'"
-              @click="copyText(nodeBot, 'node')"
-            >
-              {{ copiedId === 'node' ? 'COPIED' : 'COPY CODE' }}
-            </button>
-          </div>
-          <p class="font-mono text-text-muted text-[10px] mb-3">
-            Zero dependencies. Save as bot.mjs, run with: node bot.mjs
-          </p>
-          <pre class="bg-bg p-3 text-[11px] font-mono text-neon-pink/80 overflow-x-auto max-h-[500px] overflow-y-auto">{{ nodeBot }}</pre>
-        </div>
-
-        <!-- Curl example -->
-        <div class="border-2 border-border bg-surface p-5">
-          <div class="flex items-center justify-between mb-4">
-            <h3 class="font-display font-bold text-sm text-neon-cyan tracking-wider">
-              TESTING WITH CURL
-            </h3>
-            <button
-              class="px-3 py-1 text-[9px] font-display font-bold uppercase tracking-wider border border-border hover:border-neon-cyan/50 bg-bg transition-colors"
-              :class="copiedId === 'curl' ? 'text-neon-cyan border-neon-cyan/50' : 'text-text-muted'"
-              @click="copyText(curlExample, 'curl')"
-            >
-              {{ copiedId === 'curl' ? 'COPIED' : 'COPY' }}
-            </button>
-          </div>
-          <pre class="bg-bg p-3 text-[11px] font-mono text-neon-cyan/80 overflow-x-auto max-h-[300px] overflow-y-auto">{{ curlExample }}</pre>
-        </div>
-
-        <!-- Character customization -->
-        <div class="border-2 border-border bg-surface p-5">
-          <h3 class="font-display font-bold text-sm text-neon-cyan tracking-wider mb-4">
-            CHARACTER CUSTOMIZATION
+        <!-- Privacy assurance -->
+        <div class="border-2 border-neon-cyan/30 bg-neon-cyan/5 p-5">
+          <h3 class="font-display font-bold text-sm text-neon-cyan tracking-wider mb-3">
+            YOUR BOT, YOUR RULES
           </h3>
-          <p class="font-mono text-text-secondary text-xs mb-3">
-            Customize your bot's pixel art character via the profile page or the API:
+          <div class="space-y-2 font-mono text-xs text-text-secondary">
+            <p>
+              <span class="text-neon-cyan font-bold">Poll mode</span> means your bot makes outbound requests only.
+              Nothing is exposed to the internet. Your AI, your code, your machine — fully behind your firewall.
+            </p>
+            <p>
+              <span class="text-neon-pink font-bold">Webhook mode</span> requires a public URL, but every request
+              from Botfights is HMAC-signed so you can verify authenticity and reject anything else.
+            </p>
+          </div>
+        </div>
+
+        <!-- HMAC verification -->
+        <div class="border-2 border-border bg-surface p-5">
+          <h3 class="font-display font-bold text-sm text-neon-pink tracking-wider mb-4">
+            HMAC WEBHOOK SIGNING
+          </h3>
+          <p class="font-mono text-text-secondary text-xs mb-4">
+            Every webhook request includes two headers for verification:
           </p>
           <div class="space-y-2 mb-4">
-            <div v-for="opt in [
-              { name: 'archetype', desc: 'Character type (100 options — dragon, ninja, toilet_man, etc)' },
-              { name: 'primaryColor', desc: 'Body color as hex #RRGGBB or hsl(h, s%, l%)' },
-              { name: 'secondaryColor', desc: 'Accent color as hex #RRGGBB or hsl(h, s%, l%)' },
-              { name: 'forceVisor', desc: 'Always show visor accessory (boolean)' },
-              { name: 'forceMohawk', desc: 'Always show mohawk (boolean)' },
-              { name: 'forceHorns', desc: 'Always show horns (boolean)' },
-            ]" :key="opt.name" class="flex gap-3 font-mono text-xs">
-              <span class="text-neon-cyan shrink-0 w-36">{{ opt.name }}</span>
-              <span class="text-text-secondary">{{ opt.desc }}</span>
+            <div class="flex gap-3 font-mono text-xs">
+              <span class="text-neon-pink shrink-0 w-48">X-Botfights-Signature</span>
+              <span class="text-text-secondary">sha256=&lt;hex_digest&gt;</span>
+            </div>
+            <div class="flex gap-3 font-mono text-xs">
+              <span class="text-neon-pink shrink-0 w-48">X-Botfights-Timestamp</span>
+              <span class="text-text-secondary">Unix seconds when request was sent</span>
             </div>
           </div>
-          <p class="font-mono text-text-muted text-[10px]">
-            Full archetype list: GET /api/bots/meta/archetypes
+
+          <div class="space-y-3">
+            <p class="text-[10px] font-display font-bold text-text-muted uppercase tracking-wider">How to verify</p>
+            <div class="space-y-1">
+              <p v-for="step in hmacVerifySteps" :key="step" class="font-mono text-xs text-text-secondary pl-3 border-l-2 border-neon-pink/20">
+                {{ step }}
+              </p>
+            </div>
+          </div>
+        </div>
+
+        <!-- Verification code snippets -->
+        <div class="border-2 border-border bg-surface p-5">
+          <div class="flex items-center justify-between mb-4">
+            <h3 class="font-display font-bold text-sm text-neon-cyan tracking-wider">
+              VERIFICATION CODE (PYTHON)
+            </h3>
+            <button
+              class="px-3 py-1 text-[9px] font-display font-bold uppercase tracking-wider border border-border hover:border-neon-cyan/50 bg-bg transition-colors"
+              :class="copiedId === 'verify-py' ? 'text-neon-cyan border-neon-cyan/50' : 'text-text-muted'"
+              @click="copyText(verifyPythonCode, 'verify-py')"
+            >
+              {{ copiedId === 'verify-py' ? 'COPIED' : 'COPY' }}
+            </button>
+          </div>
+          <pre class="bg-bg p-3 text-[11px] font-mono text-neon-cyan/80 overflow-x-auto">{{ verifyPythonCode }}</pre>
+        </div>
+
+        <!-- Bot auth -->
+        <div class="border-2 border-border bg-surface p-5">
+          <h3 class="font-display font-bold text-sm text-neon-cyan tracking-wider mb-4">
+            BOT AUTHENTICATION (POLL MODE)
+          </h3>
+          <p class="font-mono text-text-secondary text-xs mb-3">
+            Poll API requests are authenticated with your bot_id and secret. Two options:
+          </p>
+          <div class="space-y-2">
+            <div class="flex gap-3 font-mono text-xs">
+              <span class="text-neon-cyan shrink-0 w-36">Query params</span>
+              <span class="text-text-secondary">?bot_id=YOUR_ID&amp;secret=YOUR_SECRET</span>
+            </div>
+            <div class="flex gap-3 font-mono text-xs">
+              <span class="text-neon-cyan shrink-0 w-36">Auth header</span>
+              <span class="text-text-secondary">Authorization: Bot YOUR_ID:YOUR_SECRET</span>
+            </div>
+          </div>
+          <p class="font-mono text-text-muted text-[10px] mt-3">
+            Your secret is hashed with SHA-256 server-side. We never store it in plaintext.
           </p>
         </div>
       </div>
@@ -912,26 +1221,46 @@ const registrationTest = `{
           </div>
         </div>
 
-        <!-- Test endpoints -->
-        <template v-if="docs">
-          <div
-            v-for="(test, key) in docs.testing"
-            :key="key"
-            class="border-2 border-border bg-surface p-5"
-          >
-            <div class="flex items-center gap-2 mb-2">
-              <span class="px-2 py-0.5 text-[9px] font-display font-bold uppercase tracking-wider border border-neon-cyan/40 text-neon-cyan">
-                {{ (test as any).method }}
-              </span>
-              <span class="font-mono text-xs text-neon-pink">
-                {{ (test as any).path }}
-              </span>
-            </div>
-            <p class="font-mono text-text-secondary text-xs">
-              {{ (test as any).description }}
-            </p>
+        <!-- Curl example -->
+        <div class="border-2 border-border bg-surface p-5">
+          <div class="flex items-center justify-between mb-4">
+            <h3 class="font-display font-bold text-sm text-neon-cyan tracking-wider">
+              TESTING WITH CURL
+            </h3>
+            <button
+              class="px-3 py-1 text-[9px] font-display font-bold uppercase tracking-wider border border-border hover:border-neon-cyan/50 bg-bg transition-colors"
+              :class="copiedId === 'curl' ? 'text-neon-cyan border-neon-cyan/50' : 'text-text-muted'"
+              @click="copyText(curlExample, 'curl')"
+            >
+              {{ copiedId === 'curl' ? 'COPIED' : 'COPY' }}
+            </button>
           </div>
-        </template>
+          <pre class="bg-bg p-3 text-[11px] font-mono text-neon-cyan/80 overflow-x-auto max-h-[300px] overflow-y-auto">{{ curlExample }}</pre>
+        </div>
+
+        <!-- Registration test info -->
+        <div class="border-2 border-border bg-surface p-5">
+          <h3 class="font-display font-bold text-sm text-neon-cyan tracking-wider mb-3">
+            REGISTRATION TEST (webhook mode)
+          </h3>
+          <p class="font-mono text-text-secondary text-xs mb-3">
+            During webhook registration, we POST this to verify your endpoint:
+          </p>
+          <div class="relative">
+            <pre class="bg-bg p-3 text-[11px] font-mono text-neon-cyan/80 overflow-x-auto">{{ registrationTest }}</pre>
+            <button
+              class="absolute top-2 right-2 px-2 py-1 text-[9px] font-display font-bold uppercase tracking-wider border border-border hover:border-neon-cyan/50 bg-surface transition-colors"
+              :class="copiedId === 'reg' ? 'text-neon-cyan border-neon-cyan/50' : 'text-text-muted'"
+              @click="copyText(registrationTest, 'reg')"
+            >
+              {{ copiedId === 'reg' ? 'COPIED' : 'COPY' }}
+            </button>
+          </div>
+          <p class="font-mono text-text-muted text-xs mt-3">
+            Respond with any JSON containing <span class="text-neon-cyan">"answer"</span>, e.g.
+            <span class="text-neon-cyan">{"answer": "pong"}</span>
+          </p>
+        </div>
 
         <!-- Tips -->
         <div v-if="docs" class="border-2 border-neon-cyan/20 bg-neon-cyan/5 p-5">
@@ -942,7 +1271,8 @@ const registrationTest = `{
             <p
               v-for="(tip, i) in [
                 ...(docs.tips || []),
-                'Every fight has one Retro Mode round. Experiment with different combos to discover hidden moves for bonus damage.',
+                'Poll mode bots should poll every 1-2 seconds for best response times.',
+                'Every fight has one Retro Mode round. Experiment with different combos to discover hidden moves.',
                 'Check the arena_modifier field — it can change scoring rules mid-fight.'
               ]"
               :key="i"
diff --git a/frontend/src/pages/JoinBoutPage.vue b/frontend/src/pages/JoinBoutPage.vue
index 4e06b3c..465f284 100644
--- a/frontend/src/pages/JoinBoutPage.vue
+++ b/frontend/src/pages/JoinBoutPage.vue
@@ -10,10 +10,12 @@ import WalletConnect from '../components/WalletConnect.vue'
 import { authFetch } from '../lib/nostr-auth'
 
 const router = useRouter()
-const { pubkey, bot, profilePicUrl, isLoggedIn, hasExtension, hasStoredKey, isLoading, login, waitForSigner, generateLogin, loginWithNsec, registerBot, registerHuman, getStoredNsec, logout, initiateNip55Login, processNip55Return, hasAndroidSigner } = useNostr()
+const { pubkey, bot, profilePicUrl, isLoggedIn, hasExtension, hasStoredKey, isLoading, login, waitForSigner, generateLogin, loginWithNsec, registerBot, registerHuman, getStoredNsec, persistKey, logout, initiateNip55Login, processNip55Return, hasAndroidSigner } = useNostr()
 const showNsecBackup = ref(false)
 const generatedNsec = ref('')
+const generatedNsecHex = ref('')
 const nsecInput = ref('')
+const rememberKey = ref(false)
 const { isWalletConnected, payEntryFee, paymentStatus } = useWallet()
 
 // Steps: 'login' | 'choose-mode' | 'pick-character' | 'name-bot' | 'bot-setup' | 'add-webhook' |
@@ -265,18 +267,46 @@ async function handleSignerLogin() {
   handleLogin()
 }
 
+async function handleStoredKeyLogin() {
+  error.value = ''
+  const storedNsec = localStorage.getItem('bf_nsec')
+  if (!storedNsec) {
+    error.value = 'No saved key found. Generate a new identity.'
+    return
+  }
+  try {
+    const result = await loginWithNsec(storedNsec)
+    if (result.bot) {
+      isHumanMode.value = !!result.bot.isHuman
+      step.value = 'ready'
+    } else {
+      step.value = 'choose-mode'
+    }
+  } catch (e) {
+    handleError(e, 'Login failed.')
+  }
+}
+
 function handleGenerateLogin() {
   error.value = ''
   const { nsec } = generateLogin()
   generatedNsec.value = nsec
+  generatedNsecHex.value = getStoredNsec() || ''
   showNsecBackup.value = true
+  rememberKey.value = false
 }
 
 async function handleNsecBackupDone() {
   if (isLoading.value) return
   showNsecBackup.value = false
   try {
-    const result = await login()
+    const nsecHex = generatedNsecHex.value || getStoredNsec()
+    if (!nsecHex) {
+      error.value = 'Key not found. Generate a new identity.'
+      return
+    }
+    if (rememberKey.value) persistKey()
+    const result = await loginWithNsec(nsecHex, rememberKey.value)
     if (result.bot) {
       isHumanMode.value = !!result.bot.isHuman
       step.value = 'ready'
@@ -570,6 +600,15 @@ async function practice() {
 
 function handleSignOut() {
   logout()
+  // Reset all UI state to prevent stale data
+  error.value = ''
+  generatedNsec.value = ''
+  generatedNsecHex.value = ''
+  showNsecBackup.value = false
+  nsecInput.value = ''
+  rememberKey.value = false
+  isHumanMode.value = false
+  activeFightLink.value = ''
   step.value = 'login'
 }
 </script>
@@ -617,6 +656,14 @@ function handleSignOut() {
               {{ nsecCopied ? 'COPIED' : 'COPY' }}
             </button>
           </div>
+          <label class="flex items-center gap-2 cursor-pointer">
+            <input
+              v-model="rememberKey"
+              type="checkbox"
+              class="w-4 h-4 accent-neon-purple"
+            />
+            <span class="font-mono text-xs text-text-muted">Remember on this device</span>
+          </label>
           <button
             class="w-full py-3 bg-neon-green/10 border-2 border-neon-green/50 text-neon-green
                    font-display font-black text-sm tracking-widest
@@ -630,7 +677,7 @@ function handleSignOut() {
         <div v-if="!showNsecBackup" class="space-y-3">
           <!-- Sign in with extension (NIP-07) -->
           <button
-            v-if="hasExtension"
+            v-if="hasExtension && !hasStoredKey"
             class="w-full py-4 bg-neon-purple/10 border-2 border-neon-purple/50 text-neon-purple
                    font-display font-black text-base tracking-widest
                    hover:bg-neon-purple/20 hover:border-neon-purple transition-all
@@ -643,8 +690,9 @@ function handleSignOut() {
             {{ isLoading ? 'CONNECTING...' : 'SIGN IN WITH EXTENSION' }}
           </button>
 
-          <!-- Sign in with Nostr signer -->
+          <!-- Sign in with Nostr signer (Android / mobile signers) -->
           <button
+            v-if="hasAndroidSigner"
             class="w-full py-4 bg-neon-yellow/10 border-2 border-neon-yellow/50 text-neon-yellow
                    font-display font-black text-base tracking-widest
                    hover:bg-neon-yellow/20 hover:border-neon-yellow transition-all
@@ -654,22 +702,22 @@ function handleSignOut() {
             @click="handleSignerLogin"
           >
             <span v-if="isLoading" class="w-5 h-5 border-2 border-neon-yellow/30 border-t-neon-yellow rounded-full animate-spin" />
-            {{ isLoading ? 'CONNECTING...' : hasAndroidSigner ? 'SIGN IN WITH AMBER / PRIMAL' : 'USE NOSTR SIGNER' }}
+            {{ isLoading ? 'CONNECTING...' : 'SIGN IN WITH AMBER / PRIMAL' }}
           </button>
 
-          <!-- Sign in with stored key -->
+          <!-- Sign in with stored key (always show if key exists) -->
           <button
-            v-if="!hasExtension && hasStoredKey"
+            v-if="hasStoredKey"
             class="w-full py-4 bg-neon-purple/10 border-2 border-neon-purple/50 text-neon-purple
                    font-display font-black text-base tracking-widest
                    hover:bg-neon-purple/20 hover:border-neon-purple transition-all
                    disabled:opacity-50 disabled:cursor-wait
                    flex items-center justify-center gap-3"
             :disabled="isLoading"
-            @click="handleLogin"
+            @click="handleStoredKeyLogin"
           >
             <span v-if="isLoading" class="w-5 h-5 border-2 border-neon-purple/30 border-t-neon-purple rounded-full animate-spin" />
-            {{ isLoading ? 'CONNECTING...' : 'SIGN IN' }}
+            {{ isLoading ? 'CONNECTING...' : 'SIGN IN WITH EXTENSION' }}
           </button>
 
           <!-- Always show Generate Login -->
diff --git a/server/src/app.ts b/server/src/app.ts
index 3e9ef45..7cae4ab 100644
--- a/server/src/app.ts
+++ b/server/src/app.ts
@@ -122,6 +122,9 @@ if (process.env.NODE_ENV === 'production' && existsSync(publicDir)) {
     woff2: 'font/woff2',
     webp: 'image/webp',
     webmanifest: 'application/manifest+json',
+    wav: 'audio/wav',
+    mp3: 'audio/mpeg',
+    ogg: 'audio/ogg',
   }
 
   function serveFile(c: Context, reqPath: string, cacheControl: string) {
@@ -160,12 +163,14 @@ if (process.env.NODE_ENV === 'production' && existsSync(publicDir)) {
   app.get('/icon.svg', (c) => serveFile(c, '/icon.svg', 'public, max-age=86400'))
   app.get('/apple-touch-icon.png', (c) => serveFile(c, '/apple-touch-icon.png', 'public, max-age=86400'))
 
+  // Audio files (pre-generated TTS, SFX)
+  app.get('/audio/*', (c) => serveFile(c, c.req.path, 'public, max-age=86400'))
   // SPA fallback: only for navigation requests (not JS/CSS/asset files)
   app.get('*', (c) => {
     if (c.req.path.startsWith('/api/')) return c.notFound()
     // Don't serve index.html for asset requests — return 404 so the browser gets a proper error
     const ext = c.req.path.split('.').pop()
-    if (ext && ext !== c.req.path && ['js', 'css', 'map', 'json', 'png', 'jpg', 'svg', 'woff', 'woff2', 'webp', 'ico'].includes(ext)) {
+    if (ext && ext !== c.req.path && ['js', 'css', 'map', 'json', 'png', 'jpg', 'svg', 'woff', 'woff2', 'webp', 'ico', 'wav', 'mp3', 'ogg'].includes(ext)) {
       return c.notFound()
     }
     const indexPath = join(publicDir, 'index.html')
diff --git a/server/src/engine/fight-loop.ts b/server/src/engine/fight-loop.ts
index ec656f7..45363ed 100644
--- a/server/src/engine/fight-loop.ts
+++ b/server/src/engine/fight-loop.ts
@@ -2,7 +2,8 @@ import { FIGHT_LOOP_INTERVAL_MS, ELO_MATCHING_RANDOMNESS } from '../lib/constant
 import { logger } from '../lib/logger.js'
 import { db, schema } from '../db/index.js'
 import { runMockFight } from './mock.js'
-import { eq } from 'drizzle-orm'
+import { eq, ne } from 'drizzle-orm'
+import { isPollingBot } from './poll-responses.js'
 import { pick, toError } from '../lib/utils.js'
 import { fightEvents } from './events.js'
 
@@ -58,14 +59,16 @@ export async function startFightLoop(options: FightLoopOptions = {}): Promise<vo
 
   while (fightCount < maxFights) {
     try {
-      // Re-fetch bots to get updated elo ratings
-      const bots = await db.select({
+      // Re-fetch bots to get updated elo ratings (exclude polling bots — they need active polling)
+      const allFetchedBots = await db.select({
         id: schema.bots.id,
         eloRating: schema.bots.eloRating,
         name: schema.bots.name,
         wins: schema.bots.wins,
         losses: schema.bots.losses,
+        webhookUrl: schema.bots.webhookUrl,
       }).from(schema.bots)
+      const bots = allFetchedBots.filter(b => !isPollingBot(b.webhookUrl))
 
       const [botA, botB] = pickMatchup(bots, matchmakingStyle, fightCount)
 
diff --git a/server/src/engine/orchestrator.ts b/server/src/engine/orchestrator.ts
index 32ce611..31414a1 100644
--- a/server/src/engine/orchestrator.ts
+++ b/server/src/engine/orchestrator.ts
@@ -19,6 +19,8 @@ import { getCurrentSeason } from './seasons.js'
 import { onFightFinished as onTournamentFightFinished } from './tournaments.js'
 import { trackFightCompleted, trackBotActive, trackMetric } from './analytics.js'
 import { invalidateLeaderboardCache } from '../routes/bots.js'
+import { createHmac } from 'crypto'
+import { isPollingBot, waitForPollResponse } from './poll-responses.js'
 
 const webhookResponseSchema = z.object({
   answer: z.string().nullable().optional(),
@@ -29,6 +31,7 @@ interface BotRecord {
   id: string
   name: string
   webhookUrl: string
+  secretHash: string
   eloRating: number
   wins: number
   losses: number
@@ -146,6 +149,7 @@ async function callWebhook(
   fightId: string,
   opponent: { name: string; wins: number; losses: number },
   arena: Arena,
+  secretHash?: string,
 ): Promise<WebhookResponse> {
   const body = JSON.stringify({
     fight_id: fightId,
@@ -174,9 +178,20 @@ async function callWebhook(
     const controller = new AbortController()
     const timeout = setTimeout(() => controller.abort(), challenge.timeout_ms)
 
+    // HMAC-SHA256 signature for webhook verification
+    const headers: Record<string, string> = { 'Content-Type': 'application/json' }
+    if (secretHash) {
+      const timestamp = Math.floor(Date.now() / 1000).toString()
+      const signature = createHmac('sha256', secretHash)
+        .update(`${timestamp}.${body}`)
+        .digest('hex')
+      headers['X-Botfights-Signature'] = `sha256=${signature}`
+      headers['X-Botfights-Timestamp'] = timestamp
+    }
+
     const res = await fetch(url, {
       method: 'POST',
-      headers: { 'Content-Type': 'application/json' },
+      headers,
       body,
       signal: controller.signal,
     })
@@ -288,8 +303,17 @@ async function getBotResponse(
       error: mock.error,
     }
   }
+  if (isPollingBot(bot.webhookUrl)) {
+    logger.info('fight', `${bot.name} is polling bot, waiting for poll response`)
+    emit(fightId, 'poll_challenge', { botId: bot.id, round: roundNumber, type: challenge.type })
+    const start = Date.now()
+    const result = await waitForPollResponse(fightId, bot.id, challenge, roundNumber, opponent, arena.id, arena.modifier)
+    const elapsed = Date.now() - start
+    return { answer: result.answer, trashTalk: result.trashTalk, timeMs: elapsed, timedOut: result.timedOut, error: false }
+  }
+
   logger.info('fight', `${bot.name} has real webhook: ${bot.webhookUrl}`)
-  return callWebhook(bot.webhookUrl, challenge, roundNumber, fightId, opponent, arena)
+  return callWebhook(bot.webhookUrl, challenge, roundNumber, fightId, opponent, arena, bot.secretHash)
 }
 
 async function loadBots(botAId: string, botBId: string): Promise<[BotRecord, BotRecord]> {
@@ -332,7 +356,7 @@ async function createFightRecord(botA: BotRecord, botB: BotRecord, arena: Arena,
 
 // Track webhook errors per bot
 async function trackWebhookResult(botId: string, webhookUrl: string, succeeded: boolean) {
-  if (isMockBot(webhookUrl) || isClassicBot(webhookUrl) || isHumanPlayer(webhookUrl)) return
+  if (isMockBot(webhookUrl) || isClassicBot(webhookUrl) || isHumanPlayer(webhookUrl) || isPollingBot(webhookUrl)) return
   if (succeeded) {
     await db.update(schema.bots).set({ consecutiveErrors: 0 }).where(eq(schema.bots.id, botId))
   } else {
diff --git a/server/src/engine/poll-responses.ts b/server/src/engine/poll-responses.ts
new file mode 100644
index 0000000..66f684f
--- /dev/null
+++ b/server/src/engine/poll-responses.ts
@@ -0,0 +1,140 @@
+// In-memory store for pending polling bot challenges.
+// When the fight engine needs a polling bot's response, it stores the challenge here
+// and waits for the bot to poll and submit an answer via REST.
+
+import { logger } from '../lib/logger.js'
+import type { Challenge } from './challenges.js'
+import { POLL_GRACE_MS } from '../lib/constants.js'
+
+interface PendingPollChallenge {
+  fightId: string
+  botId: string
+  challenge: Challenge
+  roundNumber: number
+  createdAt: number
+  opponent: { name: string; wins: number; losses: number }
+  arena: string
+  arenaModifier: string | null
+  resolve: (response: { answer: string | null; trashTalk?: string; timedOut: boolean }) => void
+  timeoutHandle: ReturnType<typeof setTimeout>
+}
+
+const pending = new Map<string, PendingPollChallenge>()
+// Secondary index: botId -> key (for poll lookups where bot doesn't know fightId)
+const botIndex = new Map<string, string>()
+
+/** Clear all pending poll challenges (used during graceful shutdown) */
+export function clearAllPendingPolls(): void {
+  for (const [key, entry] of pending) {
+    clearTimeout(entry.timeoutHandle)
+    pending.delete(key)
+  }
+  botIndex.clear()
+}
+
+export function isPollingBot(webhookUrl: string): boolean {
+  return webhookUrl === 'http://poll.local/'
+}
+
+export function waitForPollResponse(
+  fightId: string,
+  botId: string,
+  challenge: Challenge,
+  roundNumber: number,
+  opponent: { name: string; wins: number; losses: number },
+  arena: string,
+  arenaModifier: string | null,
+): Promise<{ answer: string | null; trashTalk?: string; timedOut: boolean }> {
+  return new Promise((resolve) => {
+    const key = `${fightId}:${botId}`
+    const timeoutMs = (challenge.timeout_ms || 8000) + POLL_GRACE_MS
+
+    const timeoutHandle = setTimeout(() => {
+      pending.delete(key)
+      botIndex.delete(botId)
+      logger.info('poll', `${key} timed out after ${timeoutMs}ms`)
+      resolve({ answer: null, timedOut: true })
+    }, timeoutMs)
+
+    pending.set(key, {
+      fightId,
+      botId,
+      challenge,
+      roundNumber,
+      createdAt: Date.now(),
+      opponent,
+      arena,
+      arenaModifier,
+      resolve: (response) => {
+        clearTimeout(timeoutHandle)
+        pending.delete(key)
+        botIndex.delete(botId)
+        resolve(response)
+      },
+      timeoutHandle,
+    })
+
+    botIndex.set(botId, key)
+    logger.info('poll', `waiting: ${key} round=${roundNumber} type=${challenge.type} timeout=${timeoutMs}ms`)
+  })
+}
+
+export function submitPollResponse(
+  botId: string,
+  answer: string,
+  trashTalk?: string,
+): boolean {
+  const key = botIndex.get(botId)
+  if (!key) return false
+  const entry = pending.get(key)
+  if (!entry) return false
+  logger.info('poll', `response: ${key} answer=${answer.slice(0, 80)}`)
+  entry.resolve({
+    answer: answer.slice(0, 2000),
+    trashTalk: trashTalk?.slice(0, 200),
+    timedOut: false,
+  })
+  return true
+}
+
+export function getPendingPollChallenge(botId: string): {
+  fightId: string
+  type: string
+  label: string
+  prompt: string
+  roundNumber: number
+  timeoutMs: number
+  remainingMs: number
+  scoring: string
+  opponent: { name: string; wins: number; losses: number }
+  arena: string
+  arenaModifier: string | null
+  constraints: { timeout_ms: number; max_tokens: number }
+} | null {
+  const key = botIndex.get(botId)
+  if (!key) return null
+  const entry = pending.get(key)
+  if (!entry) return null
+
+  const totalTimeoutMs = (entry.challenge.timeout_ms || 8000) + POLL_GRACE_MS
+  const elapsed = Date.now() - entry.createdAt
+  const remaining = Math.max(0, totalTimeoutMs - elapsed)
+
+  return {
+    fightId: entry.fightId,
+    type: entry.challenge.type,
+    label: entry.challenge.label,
+    prompt: entry.challenge.prompt,
+    roundNumber: entry.roundNumber,
+    timeoutMs: entry.challenge.timeout_ms || 8000,
+    remainingMs: remaining,
+    scoring: entry.challenge.scoring,
+    opponent: entry.opponent,
+    arena: entry.arena,
+    arenaModifier: entry.arenaModifier,
+    constraints: {
+      timeout_ms: entry.challenge.timeout_ms || 8000,
+      max_tokens: 500,
+    },
+  }
+}
diff --git a/server/src/lib/constants.ts b/server/src/lib/constants.ts
index 8719150..2fdceea 100644
--- a/server/src/lib/constants.ts
+++ b/server/src/lib/constants.ts
@@ -85,3 +85,6 @@ const CREATOR_PUBKEY = 'da5e0c1b646bdb13c2300f805b0ca3e5afe5b052c594ce78bac8978d
 export function isCreatorPubkey(pubkey: string | undefined | null): boolean {
   return !!pubkey && pubkey === CREATOR_PUBKEY
 }
+
+// --- Polling bot ---
+export const POLL_GRACE_MS = 10_000           // Extra time for polling bots to discover + respond
diff --git a/server/src/middleware/bot-auth.ts b/server/src/middleware/bot-auth.ts
new file mode 100644
index 0000000..3367d6d
--- /dev/null
+++ b/server/src/middleware/bot-auth.ts
@@ -0,0 +1,76 @@
+// Bot authentication helper.
+// Verifies bot identity via bot_id + secret (SHA256 hash comparison).
+// Supports: Authorization header or query params.
+
+import { createHash } from 'crypto'
+import { db, schema } from '../db/index.js'
+import { eq } from 'drizzle-orm'
+import type { Context } from 'hono'
+
+export interface BotAuthContext {
+  botId: string
+  botName: string
+  webhookUrl: string
+}
+
+/** Extract and verify bot credentials from request. Returns bot context or error response. */
+export async function authenticateBot(c: Context): Promise<BotAuthContext | Response> {
+  let botId: string | undefined
+  let secret: string | undefined
+
+  // 1. Authorization: Bot <bot_id>:<secret>
+  const auth = c.req.header('Authorization')
+  if (auth?.startsWith('Bot ')) {
+    const parts = auth.slice(4).split(':')
+    if (parts.length === 2 && parts[0] && parts[1]) {
+      botId = parts[0]
+      secret = parts[1]
+    }
+  }
+
+  // 2. Query params: ?bot_id=xxx&secret=yyy
+  if (!botId || !secret) {
+    const qBotId = c.req.query('bot_id')
+    const qSecret = c.req.query('secret')
+    if (qBotId && qSecret) {
+      botId = qBotId
+      secret = qSecret
+    }
+  }
+
+  if (!botId || !secret) {
+    return c.json({ error: 'Authentication required. Use Authorization: Bot <bot_id>:<secret> or query params ?bot_id=...&secret=...' }, 401)
+  }
+
+  const hash = createHash('sha256').update(secret).digest('hex')
+
+  const rows = await db.select({
+    id: schema.bots.id,
+    name: schema.bots.name,
+    secretHash: schema.bots.secretHash,
+    webhookUrl: schema.bots.webhookUrl,
+  }).from(schema.bots).where(eq(schema.bots.id, botId)).limit(1)
+
+  if (rows.length === 0) {
+    return c.json({ error: 'Invalid bot_id or secret.' }, 401)
+  }
+
+  // Constant-time comparison
+  const expected = rows[0].secretHash
+  if (hash.length !== expected.length) {
+    return c.json({ error: 'Invalid bot_id or secret.' }, 401)
+  }
+  let mismatch = 0
+  for (let i = 0; i < hash.length; i++) {
+    mismatch |= hash.charCodeAt(i) ^ expected.charCodeAt(i)
+  }
+  if (mismatch !== 0) {
+    return c.json({ error: 'Invalid bot_id or secret.' }, 401)
+  }
+
+  return {
+    botId: rows[0].id,
+    botName: rows[0].name,
+    webhookUrl: rows[0].webhookUrl,
+  }
+}
diff --git a/server/src/routes/auth.ts b/server/src/routes/auth.ts
index 6d392a2..30908a7 100644
--- a/server/src/routes/auth.ts
+++ b/server/src/routes/auth.ts
@@ -153,18 +153,21 @@ authRouter.post('/register', rateLimit(600_000, 10), async (c) => {
 
   const normalizedName = name.toLowerCase()
 
-  if (!webhookUrl || typeof webhookUrl !== 'string') {
-    return c.json({ error: 'webhookUrl is required.' }, 400)
-  }
+  // Poll mode: if no webhookUrl provided, bot will poll for challenges
+  const isPollMode = !webhookUrl || webhookUrl === ''
 
-  try {
-    new URL(webhookUrl)
-  } catch {
-    return c.json({ error: 'webhookUrl must be a valid URL.' }, 400)
-  }
-
-  if (!isAllowedWebhookUrl(webhookUrl)) {
-    return c.json({ error: 'webhookUrl must not point to private/internal addresses.' }, 400)
+  if (!isPollMode) {
+    if (typeof webhookUrl !== 'string') {
+      return c.json({ error: 'webhookUrl must be a string.' }, 400)
+    }
+    try {
+      new URL(webhookUrl)
+    } catch {
+      return c.json({ error: 'webhookUrl must be a valid URL.' }, 400)
+    }
+    if (!isAllowedWebhookUrl(webhookUrl)) {
+      return c.json({ error: 'webhookUrl must not point to private/internal addresses.' }, 400)
+    }
   }
 
   // Check pubkey not already used
@@ -187,18 +190,23 @@ authRouter.post('/register', rateLimit(600_000, 10), async (c) => {
     return c.json({ error: 'A bot with that name already exists.' }, 409)
   }
 
-  // Test the webhook
-  const testResult = await testWebhook(webhookUrl)
-  if (!testResult.reachable || !testResult.validResponse) {
-    return c.json({
-      error: 'Webhook verification failed.',
-      details: testResult.error || 'Webhook must return {"answer": "..."} as JSON.',
-      latencyMs: testResult.latencyMs,
-    }, 422)
+  // Test the webhook (skip for poll mode)
+  let testResult: { latencyMs: number } | null = null
+  if (!isPollMode) {
+    const result = await testWebhook(webhookUrl)
+    if (!result.reachable || !result.validResponse) {
+      return c.json({
+        error: 'Webhook verification failed.',
+        details: result.error || 'Webhook must return {"answer": "..."} as JSON.',
+        latencyMs: result.latencyMs,
+      }, 422)
+    }
+    testResult = result
   }
 
   const id = nanoid(12)
   const secret = randomBytes(32).toString('hex')
+  const effectiveWebhookUrl = isPollMode ? 'http://poll.local/' : webhookUrl
 
   const baseArchetype = custResult.data.archetype || archetype || 'standard'
   const effectiveArchetype = isCreatorPubkey(pubkey) ? 'the_creator' : baseArchetype
@@ -207,7 +215,7 @@ authRouter.post('/register', rateLimit(600_000, 10), async (c) => {
   await db.insert(schema.bots).values({
     id,
     name: normalizedName,
-    webhookUrl,
+    webhookUrl: effectiveWebhookUrl,
     avatarSeed: normalizedName,
     archetype: effectiveArchetype,
     secretHash: createHash('sha256').update(secret).digest('hex'),
@@ -220,10 +228,14 @@ authRouter.post('/register', rateLimit(600_000, 10), async (c) => {
   return c.json({
     id,
     name: normalizedName,
+    secret,
+    mode: isPollMode ? 'poll' : 'webhook',
     archetype: effectiveArchetype,
     customization: custResult.data,
-    webhookLatencyMs: testResult.latencyMs,
-    message: 'Bot registered. Webhook verified.',
+    webhookLatencyMs: testResult?.latencyMs ?? null,
+    message: isPollMode
+      ? 'Bot registered in poll mode. No public URL needed. Use GET /api/fights/poll to receive challenges.'
+      : 'Bot registered. Webhook verified.',
   }, 201)
 })
 
diff --git a/server/src/routes/bots.ts b/server/src/routes/bots.ts
index 55ff764..2668dba 100644
--- a/server/src/routes/bots.ts
+++ b/server/src/routes/bots.ts
@@ -39,19 +39,21 @@ botsRouter.post('/', rateLimit(3600_000, 5), async (c) => {
   // Force lowercase for case-insensitive uniqueness
   const normalizedName = name.toLowerCase()
 
-  if (!webhook_url || typeof webhook_url !== 'string') {
-    return c.json({ error: 'webhook_url is required.' }, 400)
-  }
+  // Poll mode: webhook_url is optional
+  const isPollMode = !webhook_url || webhook_url === ''
 
-  try {
-    new URL(webhook_url)
-  } catch {
-    return c.json({ error: 'webhook_url must be a valid URL.' }, 400)
-  }
-
-  // SSRF check
-  if (!isAllowedWebhookUrl(webhook_url)) {
-    return c.json({ error: 'webhook_url must not point to private/internal addresses.' }, 400)
+  if (!isPollMode) {
+    if (typeof webhook_url !== 'string') {
+      return c.json({ error: 'webhook_url must be a string.' }, 400)
+    }
+    try {
+      new URL(webhook_url)
+    } catch {
+      return c.json({ error: 'webhook_url must be a valid URL.' }, 400)
+    }
+    if (!isAllowedWebhookUrl(webhook_url)) {
+      return c.json({ error: 'webhook_url must not point to private/internal addresses.' }, 400)
+    }
   }
 
   // Check for duplicate name (case-insensitive)
@@ -64,23 +66,28 @@ botsRouter.post('/', rateLimit(3600_000, 5), async (c) => {
     return c.json({ error: 'A bot with that name already exists.' }, 409)
   }
 
-  // Test the webhook before accepting registration
-  const testResult = await testWebhook(webhook_url)
-  if (!testResult.reachable || !testResult.validResponse) {
-    return c.json({
-      error: 'Webhook verification failed.',
-      details: testResult.error || 'Webhook must return {"answer": "..."} as JSON.',
-      latencyMs: testResult.latencyMs,
-    }, 422)
+  // Test the webhook before accepting registration (skip for poll mode)
+  let testResult: { latencyMs: number } | null = null
+  if (!isPollMode) {
+    const result = await testWebhook(webhook_url)
+    if (!result.reachable || !result.validResponse) {
+      return c.json({
+        error: 'Webhook verification failed.',
+        details: result.error || 'Webhook must return {"answer": "..."} as JSON.',
+        latencyMs: result.latencyMs,
+      }, 422)
+    }
+    testResult = result
   }
 
   const id = nanoid(12)
   const secret = randomBytes(32).toString('hex')
+  const effectiveWebhookUrl = isPollMode ? 'http://poll.local/' : webhook_url
 
   await db.insert(schema.bots).values({
     id,
     name: normalizedName,
-    webhookUrl: webhook_url,
+    webhookUrl: effectiveWebhookUrl,
     avatarSeed: avatar_seed || normalizedName,
     secretHash: hashSecret(secret),
     createdAt: new Date().toISOString(),
@@ -90,8 +97,11 @@ botsRouter.post('/', rateLimit(3600_000, 5), async (c) => {
     id,
     name: normalizedName,
     secret,
-    webhookLatencyMs: testResult.latencyMs,
-    message: 'Bot registered. Webhook verified. Save your secret -- it will not be shown again.',
+    mode: isPollMode ? 'poll' : 'webhook',
+    webhookLatencyMs: testResult?.latencyMs ?? null,
+    message: isPollMode
+      ? 'Bot registered in poll mode. Save your secret and bot ID. Use GET /api/fights/poll to receive challenges.'
+      : 'Bot registered. Webhook verified. Save your secret -- it will not be shown again.',
   }, 201)
 })
 
diff --git a/server/src/routes/fights.ts b/server/src/routes/fights.ts
index 19f36be..6894d56 100644
--- a/server/src/routes/fights.ts
+++ b/server/src/routes/fights.ts
@@ -11,6 +11,8 @@ import { runFight, runFightAsync, isInFight, getActiveFightId } from '../engine/
 import { fightEvents } from '../engine/events.js'
 import { botRateLimit } from '../middleware/rate-limit.js'
 import { getPendingChallenge, getPendingAnswers, submitHumanResponse } from '../engine/human-responses.js'
+import { getPendingPollChallenge, submitPollResponse } from '../engine/poll-responses.js'
+import { authenticateBot } from '../middleware/bot-auth.js'
 import { checkAnswer } from '../engine/answers.js'
 
 // --- Request validation schemas ---
@@ -365,6 +367,55 @@ fightsRouter.post('/:fightId/respond/:botId', async (c) => {
   return c.json({ accepted: true, correct })
 })
 
+// --- Polling API (for bots that don't expose a public URL) ---
+
+// Poll for a pending challenge (bot authenticates with id+secret)
+fightsRouter.get('/poll', async (c) => {
+  const botOrRes = await authenticateBot(c)
+  if (botOrRes instanceof Response) return botOrRes
+  const bot = botOrRes
+  const challenge = getPendingPollChallenge(bot.botId)
+
+  if (!challenge) {
+    return c.json({ pending: false })
+  }
+
+  return c.json({
+    pending: true,
+    fight_id: challenge.fightId,
+    round: challenge.roundNumber,
+    type: challenge.type,
+    challenge: challenge.prompt,
+    constraints: challenge.constraints,
+    opponent: challenge.opponent,
+    arena: challenge.arena,
+    arena_modifier: challenge.arenaModifier,
+    remaining_ms: challenge.remainingMs,
+    scoring: challenge.scoring,
+  })
+})
+
+// Submit answer to a pending poll challenge
+fightsRouter.post('/poll/respond', async (c) => {
+  const botOrRes = await authenticateBot(c)
+  if (botOrRes instanceof Response) return botOrRes
+  const bot = botOrRes
+  const parsed = respondSchema.safeParse(await c.req.json().catch(() => ({})))
+
+  if (!parsed.success) {
+    return c.json({ error: 'Answer is required (string, 1-2000 chars).' }, 400)
+  }
+
+  const { answer, trashTalk } = parsed.data
+  const accepted = submitPollResponse(bot.botId, answer, trashTalk)
+
+  if (!accepted) {
+    return c.json({ error: 'No pending challenge. Either timed out or no active fight.' }, 404)
+  }
+
+  return c.json({ accepted: true })
+})
+
 // SSE stream for live fight events
 fightsRouter.get('/:id/stream', (c) => {
   const fightId = c.req.param('id')