Authentication

Learn about advanced setups from our how-tos.

How to set up OAuth 2.0 authentication

Notice
Use this how-to when working with the Login library.

OAuth 2.0 uses short-lived tokens with long-term authorization (refresh tokens) instead of long-lived tokens. A refresh token allows users to stay in your application for an extended period of time without needing to re-enter their username and password. This eliminates the risk of compromising user authentication data.

Set up OAuth 2.0 for authorization:

  • via username or email and password
  • via social networks

If this option is enabled, user registration and authentication is carried out by calling the Register new user and JWT auth by username and password API calls. The Login library provides the same methods for OAuth 2.0 authorization as for JWT token authorization.

Note
Enabling this setting doesn’t change the authentication process in your application for the user.

To configure OAuth 2.0 authorization:

  1. Set up OAuth 2.0 authentication for Login project in your Publisher Account.
  2. Initialize the library.

Set up OAuth 2.0 authentication for Login project in your Publisher Account

  1. Go to your Publisher Account.
  2. Click Open in the Login block and go to Login projects.
  3. Click Open and set up in the Login project block.
  4. Go to General settings > Authorization.
  5. Click Connect in the OAuth 2.0 authentication block.
  6. Specify OAuth 2.0 redirect URIs and click Connect.
  7. Copy and save the Client ID.

Initialize the library

To initialize the library, add the following line to your Android project source code, specifying the following parameters:

  • login-project-idLogin ID found in Publisher Account > Login settings > Login ID.
  • oauth2-client-idClient ID received when setting up OAuth 2.0 in Publisher Account.

Copy
Full screen
Small screen
val loginConfig = LoginConfig.OauthBuilder()
                .setProjectId("login-project-id")
                .setOauthClientId("oauth2-client-id")
                .build()

XLogin.init(applicationContext, loginConfig)

The following methods are implemented in Login library to work with refresh tokens:

  • XLogin.refreshToken — refreshes the token.
  • XLogin.getToken — returns the current token.
  • XLogin.isTokenExpired — returns true if the token is expired.

Was this article helpful?
Thank you!
Is there anything we can improve? Message
We’re sorry to hear that
Please explain why this article wasn’t helpful to you. Message
Thank you for your feedback!
We’ll review your message and use it to help us improve your experience.
Hide

How to use your own login system

Notice
Use this how-to when working with the following libraries:
  • Store
  • Payments
  • Inventory

You can integrate Store, Payments and Inventory libraries with your own login system. To do this, implement user authentication in your application via Pay Station access token.

The flow of interaction with Xsolla servers when using your own authorization system:

  1. Your client sends an authentication request to your server.
  2. Your server authorizes the user and sends a request to the Xsolla server to receive the Pay Station access token.
  3. Xsolla server returns the Pay Station access token.
  4. Your server passes the Pay Station access token to the client.
  5. SDK methods use the received Pay Station access token as an authorization token to open an in-game store, make a payment, and manage inventory.

Get Pay Station access token

Note
If you use the PlayFab or Firebase authorization system, get the Pay Station access token using Xsolla ready-made extensions for BaaS.

On the back end of your application, implement a method to obtain a Pay Station access token using an HTTP POST request.

Xsolla API uses basic HTTP authentication. The request must contain the Authorization: Basic <your_authorization_basic_key> header, where <your_authorization_basic_key> is the merchant_id:api_key encoded according to the Base64 standard. You can find the parameter values in Publisher Account:

  • for merchant_id, go to the Project settings > Webhooks > Merchant ID section.
  • for api_key, go to the Company settings > API key section.

HTTP request:

Copy
Full screen
Small screen
POST https://api.xsolla.com/merchant/v2/merchants/{merchant_id}/token

To get the token, pass the following parameters in the request body:

ParameterTypeDescription
settings
objectCustom project settings (object).
settings.project_id
integerGame’s Xsolla ID. Can be found in Publisher Account beside the name of your project. Required.
user
objectUser details (object).
user.id
objectUser ID in your authorization system (object).
user.id.value
stringUser ID. Required.
user.email
objectUser email (object).
user.email.value
stringUser email. Must be valid according to the RFC 822 protocol. Required.
user.name
objectUser screen name (object). Required.
user.name.value
stringUser screen name
user.steam_id
objectUser Steam ID (object).
user.steam_id.value
stringUser Steam ID. Required if the application is published on Steam.
user.playfab_id
objectUser PlayFab ID (object)
user.playfab_id.value
stringUser PlayFab ID. Required if the application uses PlayFab services to grant items.

See examples of requests and responses in the API reference.

Note
In the request, use only parameters from the list above. Don’t pass other parameters of the API call (custom_parameters, purchase, etc.), they are not intended to receive an authorization token.

Use Pay Station access token

To use the Pay Station access token to open an in-game store, make a payment, and manage inventory, pass it to the XStore.init method.

Implement the logic of receiving a new Pay Station access token after its expiration. It is recommended that you get a new token in the background mode, so the user doesn’t have to log in to the application again.

Note
The lifetime of the Pay Station access token when working with the in-game store and inventory is 1 hour after the last call to the Xsolla API. To change the lifetime of the Pay Station access token, contact your Account Manager.
Was this article helpful?
Thank you!
Is there anything we can improve? Message
We’re sorry to hear that
Please explain why this article wasn’t helpful to you. Message
Thank you for your feedback!
We’ll review your message and use it to help us improve your experience.
Hide

How to set up native authentication via social networks

Notice
Use this how-to when working with the Login library.

Native authentication lets users log in to your application via a social network account configured on a mobile device.

The first time a user logs in, the social networking application is launched and asks for permission to authenticate the user. After that, authentication is performed automatically without requiring the user to do anything.

Currently, SDK has implemented native authentication via the following social networks:

  • Google
  • Facebook
  • WeChat
  • QQ

To configure native authentication:

  1. Configure the application in the developer account for the social network:
    1. For authentication via Facebook:
      1. Register and create a new application.
      2. Set up the application page in your Facebook developer account.
    2. For authentication via Google, set up the project in Google API Console.
    3. For authentication via WeChat:
      1. Register and create a new application.
      2. Submit the application for review.
    4. For authentication via QQ:
      1. Register and create a new application.
      2. Submit the application for review.

  1. Set up authentication via social networks on the Xsolla side:
    1. For Facebook and Google, set up social connections in Publisher Account.
    2. For WeChat and QQ, contact your Account Manager.

  1. Install libraries for authenticating via social network. To do this, open the build.gradle file of your application and in the dependencies section add the following lines, where <version_number> is the required version of the library:
    • For authentication via Facebook:

Copy
Full screen
Small screen
implementation 'com.xsolla.android:login-facebook:<version_number>'

    • For authentication via Google:

Copy
Full screen
Small screen
implementation 'com.xsolla.android:login-google:<version_number>'

    • For authentication via WeChat:

Copy
Full screen
Small screen
implementation 'com.xsolla.android:login-wechat:<version_number>'

    • For authentication via QQ:

Copy
Full screen
Small screen
implementation 'com.xsolla.android:login-qq:<version_number>'

  1. Initialize the Login library with the following parameters:
    • facebook_idApp ID from the Facebook developer account
    • google_idClient ID for web application from the Google API Console
    • wechat_idAppID from the WeChat developer account
    • qq_idAppID from the QQ developer account

An example of initializing the library when authenticating via JWT:

Copy
Full screen
Small screen
val loginConfig = LoginConfig.JwtBuilder()
                .setProjectId("login-project-id")
                .setSocialConfig(XLogin.SocialConfig(
                     facebookAppId = "facebook_id",
                     googleServerId = "google_id",
                     wechatAppId = "wechat_id",
                     qqAppId = "qq_id"
                ))
                .build()

XLogin.init(applicationContext, loginConfig)

An example of initializing the library when authenticating via OAuth 2.0:

Copy
Full screen
Small screen
val loginConfig = LoginConfig.OauthBuilder()
                .setProjectId("login-project-id")
                .setOauthClientId("oauth2-client-id")
                .setSocialConfig(XLogin.SocialConfig(
                     facebookAppId = "facebook_id",
                     googleServerId = "google_id",
                     wechatAppId = "wechat_id",
                     qqAppId = "qq_id"
                ))

                .build()

XLogin.init(applicationContext, loginConfig)

  1. For authentication via WeChat, modify the application code:
    • Add the WXEntryActivity class to the <your_package_name>.wxapi package, where <your_package_name> is the name of your application package:

Copy
Full screen
Small screen
package <your_package_name>.wxapi

import android.app.Activity
import android.os.Bundle
import com.tencent.mm.opensdk.modelbase.BaseReq
import com.tencent.mm.opensdk.modelbase.BaseResp
import com.tencent.mm.opensdk.openapi.IWXAPI
import com.tencent.mm.opensdk.openapi.IWXAPIEventHandler
import com.tencent.mm.opensdk.openapi.WXAPIFactory
import com.xsolla.android.login.social.LoginSocial

class WXEntryActivity : Activity(), IWXAPIEventHandler {

    private lateinit var iwxapi: IWXAPI

    override fun onCreate(savedInstanceState: Bundle?) {
        super.onCreate(savedInstanceState)

        iwxapi = WXAPIFactory.createWXAPI(this, LoginSocial.wechatAppId, false)
        iwxapi.handleIntent(intent, this)
        finish()
    }

    override fun onReq(req: BaseReq?) {
    }

    override fun onResp(resp: BaseResp) {
        LoginSocial.wechatResult = resp
    }
}

    • Add the following element to your AndroidManifest.xml file:

Copy
Full screen
Small screen
<activity
            android:name=".wxapi.WXEntryActivity"
            android:exported="true">

Set up application page in your Facebook developer account

  1. Go to project settings in the Facebook developer account.
  2. Go to Settings > Basic.
  3. Click Add Platform and select Android.
  4. Specify the package name of your Android application in the Google Play Package Name field.
  5. Specify a fully qualified class name of the default Activity in the Class Name field.
  6. Generate a hash key and specify it in the Key Hashes field.
  7. Click Save Changes.

For further native authentication configuration, you will need App ID and App Secret found in project settings in Settings > Basic section.

Set up project in Google API Console

  1. Go to Google API Console.
  2. Click New Project.
  3. Specify Project name and Location and click Save.
  4. Go to the created project and click OAuth consent screen in the side menu.
  5. Select External option and click Create.
  6. Specify the necessary parameters and click Save.
  7. Click Credentials in the side menu.
  8. Create an OAuth 2.0 client for your Android app:

    1. Click Create credentials and select OAuth client ID.
    2. Specify Android in the Application type field.
    3. Specify Name.
    4. Specify package name of your Android application in the Package name field.
    5. Get the SHA-key.
    6. Specify SHA-key generated in the previous step SHA-key in the SHA-1 certificate fingerprint field.
    7. Click Create.
    8. Click OK.

  1. Create an OAuth 2.0 client for the web application:
    1. Click Create credentials and select OAuth client ID.
    2. Specify Web application in the Application type field.
    3. Specify Name.
    4. Click Add URI in the Authorized redirect URIs section and specify https://login.xsolla.com/api/social/oauth2/callback URI.
    5. Click Create.
    6. Click OK.

For further native authentication configuration, you will need Client ID and Client Secret found in settings of the Client ID for the web application.

Set up social connections for Login project in Xsolla Publisher Account

  1. Open your project in Publisher Account.
  2. Click Login in the side menu and go to Login projects > your Login project > Social connections.
  3. To set up authentication via Facebook:

    1. Click Edit in the Facebook panel and change status to Disconnected.
    2. Specify the App ID from the Facebook developer account in the Application ID field.
    3. Specify App Secret from the Facebook developer account in the Application Secret field.
    4. Click Connect.

  1. To set up authentication via Google:
    1. Click Edit in the Google panel and change status to Disconnected.
    2. Specify the Client ID for a web application from the Google API Console in the Application ID field.
    3. Specify the Client Secret for a web application from the Google API Console in the Application Secret field.
    4. Click Connect.

Was this article helpful?
Thank you!
Is there anything we can improve? Message
We’re sorry to hear that
Please explain why this article wasn’t helpful to you. Message
Thank you for your feedback!
We’ll review your message and use it to help us improve your experience.
Hide

How to set up token invalidation

Notice
Use this how-to when working with the Login library.

Token invalidation allows for improved security of user authentication data in your application. If the option is enabled, a new token replaces the old one that becomes invalid every time the user authenticates.

Note
You can configure token invalidation for authentication that uses a JWT token. For OAuth 2.0 authentication, token invalidation is provided by the protocol itself and does not need to be configured separately.

When using the Login library, invalidation of the existing token and generation of a new one is made by calling Auth by username and password and Auth via social network API calls, if the with_logout parameter has the 1 value.

To use token invalidation in your Android project, you need to pass the withLogout = true parameter in the XLogin.login, XLogin.startSocialAuth, and XLogin.finishSocialAuth methods.

Was this article helpful?
Thank you!
Is there anything we can improve? Message
We’re sorry to hear that
Please explain why this article wasn’t helpful to you. Message
Thank you for your feedback!
We’ll review your message and use it to help us improve your experience.
Hide
Last updated: September 1, 2021

Found a typo or other text error? Select the text and press Ctrl+Enter.

Report a problem
We always review our content. Your feedback helps us improve it.
Provide an email so we can follow up
Thank you for your feedback!