Mobile, OTP, four-digit PIN: three numbers and you are in

The mobile install path is the signed APK download. The iOS path uses Safari add-to-home-screen.

The login screen is reached from the homepage, from the mobile drawer, from the header CTA, or directly from the lobby. On mobile, the install path is the signed APK on /apk-download/ (Android) and Safari add-to-home-screen (iOS).

The login button itself is the same on every entry point: it routes to the sponsored /Login/playnow with the rel="sponsored nofollow noopener noreferrer" marker. The marker tells crawlers the entry is sponsored and excludes it from the editorial link graph.

If the PIN is forgotten, the recovery flow resets via OTP. The wallet remains locked until the new PIN is confirmed.

After login, the wallet shows one INR balance and the four vertical tabs: games, fantasy, rummy, sports.

The post-login wallet screen shows the single INR balance, the welcome tier badge (if the welcome tier is still active), the KYC status, and the responsible-play settings shortcut. The four vertical tabs sit below the wallet summary: games (973 from 8 studios), fantasy (cricket, football, NBA), rummy (tables), and sports (pre-match and in-play).

The KYC status on the wallet screen is one of three states: not started, pending review, or verified. Withdrawal is gated until verified.

The Android install path on /apk-download/ verifies the package signature before opening the installer. The iOS path uses Safari add-to-home-screen and skips the APK step.

After install, the first launch routes to the same login screen the web path uses. The wallet and the PIN are the same; the install does not create a second identity.

khelo bet24 does not use email or password. The credential model is mobile + OTP + PIN. The reason is the deployment context: the lobby is opened on mobile, often from a fresh device, and a four-digit PIN is faster to enter on a numeric keypad than a password on a full keyboard.

The credential model on khelo bet24 is mobile + OTP + four-digit PIN. The model is not a downgrade of email + password; it is a deployment-fit choice. The lobby is opened on mobile, often from a fresh device, and a four-digit PIN is faster to enter on a numeric keypad than a password on a full keyboard.

The mobile number is the account identifier. The OTP proves the holder of the mobile number at sign-in. The four-digit PIN is the only secret the account carries. The PIN is server-side only; the client never sees it after entry.

The lockout rule is three wrong PINs in a row, after which the account locks for 30 minutes. The lockout is a brute-force defence. The OTP path can still be used during the lockout for PIN recovery; the recovery flow re-issues the PIN via OTP.

The session model is server-side. The session token is cleared on logout. The PIN is never stored on the client; the OTP is single-use and expires after five minutes. The credential model is designed so that a stolen device yields only a locked screen, not a usable credential.

The credential model is the simplest model that fits the deployment context. A more complex model (email + password + security questions) would not improve the security posture and would slow the reader down on a numeric keypad. The model holds the deployment fit without sacrificing the security baseline.

After login, the reader lands on the wallet screen. The wallet screen is the post-login home: it shows the single INR balance, the welcome tier badge (if active), the KYC status, the responsible-play settings shortcut, and the four vertical tabs.

Single INR balance. The balance is shared across the four verticals. A stake in games draws from the same balance as a fantasy contest entry or a sportsbook bet. A win returns to the same balance. There is no second balance to track.

Welcome tier badge. The badge shows the active welcome tier (1, 2 or 3). The badge disappears when the welcome wagering requirement is met. The badge is informational; it does not affect the balance display.

KYC status. The status is one of three: not started, pending review, or verified. Withdrawal is gated until verified. The KYC document set is on /wallet-kyc/.

Responsible-play shortcut. The shortcut exposes the deposit caps, the cooldown and the self-exclusion controls. The shortcut is the entry point to the rules on /responsible-play/.

Four vertical tabs. Games (973 from 8 studios), Fantasy (cricket, football, NBA), Rummy (tables), Sports (pre-match and in-play). The tabs share the wallet; the verticals do not have separate balances.

Logout returns the reader to the homepage and clears the session token. The PIN is never stored client-side; the OTP is single-use and expires after five minutes. The session token is the only client-side artefact, and it is cleared on logout.

The session ledger (stake total, win total, net position) is reset on logout. The session history is retained for the last 30 sessions and is visible from the wallet screen on the next login. The history is for the reader's own review; the editorial reference does not publish per-session data.

The cookies the lobby writes during the session are cleared on the reader's browser only if the reader clears them locally. The cookies panel on /cookies/ documents the cookies the lobby writes. The closure path on /delete-account/ does not clear the cookies on the reader's browser; the reader clears them locally if desired.

Logout is the boundary between the live session and the persisted state. The persisted state (KYC, balance, tier, responsible-play settings) survives logout; the live state (session token, in-progress bets, session ledger) does not. The boundary is the credential model's contract.