A player can attach more ways of signing in to the player they already are, keeping their id and their save files. This is how an anonymous player stops depending on one device: once Steam or a dasmaffin.com account is attached, signing in with it anywhere leads back to them. The device key keeps working too.
An account that already belongs to another player answers 409; players are never merged.
Steam:
POST /me/logins/steam
Authorization: Bearer mgds_...
{ "ticket": "140000006a..." }
s&box:
POST /me/logins/sbox
Authorization: Bearer mgds_...
{ "steamId": "76561198000000001", "token": "..." }
dasmaffin.com, through the browser exactly as signing in is, but at these addresses and with the session:
POST /me/logins/dasmaffin -> { requestId, pollToken, url, expiresAt, pollEverySeconds }
POST /me/logins/dasmaffin/poll { "requestId": "...", "pollToken": "..." }
The poll answers 202 until they have allowed it, then 200; 403 if they said no, 410 once
expired or collected.
Removing one:
DELETE /me/logins/{anonymous|steam|sbox|dasmaffin}
Never the last one (409): a player nobody can sign in as would be lost.
Each of these answers with the player's ways in now, by provider: anonymous, steam, sbox,
dasmaffin.
{ "playerId": "...", "logins": [ "anonymous", "steam" ] }