Custom storage

If you use a custom storage, you have access to the following features:

Interaction flow

You can use the login widget or your application, that uses Login API calls, as a client. The interaction flow between the client and the Xsolla Login server is the following:

  1. The client sends requests to the Xsolla Login server. The requests format is described in JWT and Password endpoints.
  2. The Xsolla Login server sends requests to your server. Follow the instruction to validate the requests.
  3. The Xsolla Login server processes a response from your server and returns the result to the client.
  4. The client processes the response.

User registration

  1. The client sends the Register new user request to the Xsolla Login server.
  2. The Xsolla Login server sends a request to the New user URL. The response must be in the format described in this instruction.

Request example:

Copy
Full screen
Small screen
http
  • http
  • curl
POST https://your.hostname/your_registration_uri HTTP/1.1
Authorization: Bearer {JWT}
Content-Type: application/json

{
  "email": "john@gmail.com",
  "password": "123456"
}
curl --request POST \
  --url 'https://your.hostname/your_registration_uri' \
  --header 'authorization: bearer_JWT' \
  --header 'content-type: application/json' \
  --data '{"email":"john@gmail.com","password":"123456"}'

  1. User data is written to the Xsolla database while the email is flagged as unconfirmed. The user will receive an account confirmation email.
  2. If you have integrated the Login Widget, the user will be redirected to the page with the following message: Please confirm your account following the instructions we sent to {email}.

Authentication via username and password

  1. The client sends the Auth by username and password request to the Xsolla Login server.
  2. The Xsolla Login server sends a request to the User verification URL. The response must be in the format described in this instruction.

Request example:

Copy
Full screen
Small screen
http
  • http
  • curl
POST https://your.hostname/your_authentication_uri HTTP/1.1
Authorization: Bearer {JWT}
Content-Type: application/json

{
  "email": "john@gmail.com",
  "password": "123456"
}
curl --request POST \
  --url 'https://your.hostname/your_authentication_uri' \
  --header 'authorization: bearer_JWT' \
  --header 'content-type: application/json' \
  --data '{"email":"john@gmail.com","password":"123456"}'

  1. The Xsolla Login server generates a user JWT.
  2. The user is redirected to the login_url with a token query parameter. The token parameter contains the user JWT.

Note
A new user is created if there is no userdata written to the Xsolla database.

Passwordless authentication via phone number

  1. The client opens an authentication form so the user can enter their phone number.
  2. The user enters their phone number.
  3. The client sends the Start auth by phone number request to the Xsolla Login server.
  4. The client shows a field so the user can fill in the verification code.
  5. The user enters the received verification code.
  6. The client sends the Complete auth by phone number request to the Xsolla Login server.
  7. If it is the first user authorization, the Xsolla Login server sends a request to the Passwordless login with phone URL. The response must be in the format described in this instruction.

Request example:

Copy
Full screen
Small screen
http
  • http
  • curl
POST https://your.hostname/your_phone_authentication_uri HTTP/1.1
Authorization: Bearer {JWT}
Content-Type: application/json

{
  "login": "+12025550140",
  "type": "phone"
}
curl --request POST \
  --url 'https://your.hostname/your_phone_authentication_uri' \
  --header 'authorization: bearer_JWT' \
  --header 'content-type: application/json' \
  --data '{"login":"+12025550140","type":"phone"}'

Authentication via social networks

To get user data while authenticating via social networks, specify Social Auth Webhook URL. The request with data, received from a social network, will be sent to it. Send your Social Auth Webhook URL to the Account Manager to get access to this feature.

Authentication flow:

  1. The client sends the Auth via social network request to the Xsolla Login server.
  2. The user logs in to a social network.
  3. The Xsolla Login server processes the user data received from a social network and sends a request to Social Auth Webhook URL. The response must be in the format described in this instruction.

The request contains data in the temporary token in the Authorization: Bearer <JWT> header. The user JWT passed in the request contains the following data:

ClaimTypeDescription
expUnix TimestampThe date and time of the JWT expiry. The JWT lifetime is 7 minutes. Required.
iatUnix TimestampThe date and time JWT is issued. Required.
issstringThe service that signed the JWT: https://login.xsolla.com. Required.
request_typestringConstant: gateway_request. Required.
xsolla_login_project_idstring (UUID)Your Login project ID in Publisher Account. Required.
emailstringUser email address.
substring (UUID)User ID written on the Xsolla Login server side. Required.
usernamestringUsername.
providerstringName of a social network used for authentication. Required.
idstringUser ID in a social network. Required.

Example of a token payload:

Copy
Full screen
Small screen
{
  "exp": 1573635020,
  "iat": 1573634600,
  "iss": "https://login.xsolla.com",
  "request_type": "gateway_request",
  "xsolla_login_project_id": "00000000-0000-0000-0000-000000000000",
  "sub": "00000000-0000-0000-0000-000000000000",
  "email": "example@test.com",
  "username": "Smith707",
  "provider": "google",
  "id": "123",
}

Request example:

Copy
Full screen
Small screen
http
  • http
  • curl
POST https://your.hostname/your_social_authentication_uri HTTP/1.1
Authorization: Bearer {JWT}
Content-Type: application/json

{}
curl --request POST \
  --url 'https://your.hostname/your_social_authentication_uri' \
  --header 'authorization: bearer_JWT' \
  --header 'content-type: application/json'

User password reset

  1. The client sends the Reset password request to the Xsolla Login Server.
  2. The Xsolla Login server sends the user a password reset confirmation email.
  3. After confirming password reset in the email, the user is redirected to the page where they can enter a new password.
  4. The user enters a new password.
  5. The Xsolla Login server sends a request to the Password reset URL. The response must have the format described in this instruction.

Request example:

Copy
Full screen
Small screen
http
  • http
  • curl
POST https://your.hostname/your_reset_uri HTTP/1.1
Authorization: Bearer {JWT}
Content-Type: application/json

{
  "username": "john@gmail.com",
  "fields": {
    "password": "NewPa$$word1"
  }
}
curl --request POST \
  --url 'https://your.hostname/your_reset_uri' \
  --header 'authorization: bearer_JWT' \
  --header 'content-type: application/json' \
  --data '{"email":"john@gmail.com","fields":{"password":"NewPa$$word1"}}'

Was this article helpful?
Thank you!
Is there anything we can improve? Message
We’re sorry to hear that
Please explain why this article wasn’t helpful to you. Message
Thank you for your feedback!
We’ll review your message and use it to help us improve your experience.
Rate this page
Rate this page
Is there anything we can improve?

Don’t want to answer

Thank you for your feedback!

Continue reading

Last updated: August 16, 2021

Found a typo or other text error? Select the text and press Ctrl+Enter.

Report a problem
We always review our content. Your feedback helps us improve it.
Provide an email so we can follow up
Thank you for your feedback!