Silent authentication

How it works

Silent authentication allows you to automatically authenticate users in your game via a publishing platform. The Steam, Xbox Live, and Epic Games platforms are currently supported. If you need support for the Stone or Mail.ru platforms, contact your Customer Success Manager or email to csm@xsolla.com.

Interaction flow:

1. User launches your game.
2. The game receives platform authorization data through the platform SDK.
3. Your game generates and sends a request to the Xsolla Login server to get a JWT.
4. The Xsolla Login server authenticates the user and sends the JWT.

Who can use it

Partners who have already integrated Login and have a publishing platform account.

How to get it

1. Set up silent authentication in Publisher Account.
2. Complete integration steps on the side of your application.

Setting up silent authentication

In the Login product, two approaches to enabling silent authentication are implemented:

• by configuring the classic login option (see instructions below);
• by creating a shadow Login project (see How to set up a shadow Login project).

1. Open your project in Publisher Account and go to the Login section.
2. Click Configure in the panel of a classic login option.
3. Go to the Authentication block and select the Publishing platforms section.

4. To connect a publishing platform, click the ⚙ icon next to its name and select Settings.

5. In the modal window, specify the parameters for the selected platform:
   • Steam:
     • Application ID — AppID of your account on the platform;
     • Application secret key — Web API Key.
   • Epic Games:
     • Application ID — Client ID of the client of your game on the platform;
     • Application secret key — Secret key of the client of your game on the platform.
   • Xbox Live:
     • Application ID — Application ID/Client ID of your game on the platform;
     • Application secret key — Application Secret generated when your game was registered on the platform.

6. Click Connect.
7. Repeat steps 4 – 6 for other publishing platforms, if required.

Application side integration

Use the instruction for the publishing platform that hosts your application:

• Steam
• Xbox Live
• Epic Games

Steam

1. Get the session ticket.
2. Pass it to the silent authentication request (JWT or OAuth 2.0) as a session_ticket parameter.

Xbox Live

1. Form a session ticket (session_ticket parameter) based on the platform data after user authentication. The parameter is formed based on the <xid>-<uhs>;<XSTSToken> template where:
   • <xid> — Xbox User ID;
   • <uhs> — user hash;
   • <XSTSToken> — Xbox Secure Token Service.
2. Pass the session_ticket parameter to the silent authentication request (JWT or OAuth 2.0).

Epic Games

1. Get the exchangecode authorization code from the platform, which is generated after user authentication.
2. Pass the received exchangecode to the silent authentication request (JWT or OAuth 2.0) as the session_ticket parameter.