OAuth 2.0 uses short-lived tokens with long-term authorization (refresh tokens) instead of long-lived tokens. A refresh token allows users to stay in your application for an extended period of time without needing to re-enter their username and password. This eliminates the risk of compromising user authentication data.

Set up OAuth 2.0 for authorization:

• via username or email and password
• via social networks
• via Steam

If the option is enabled, user registration and authentication is carried out by calling the Register new user and JWT auth by username and password API calls. The Login & Account System plug-in provides the same methods for OAuth 2.0 authorization as for JWT token authorization. In the FXsollaAuthToken structure, the refresh token is specified in the RefreshToken field.

To configure OAuth 2.0 authorization:

1. Set up OAuth 2.0 authentication for Login project in your Publisher Account.
2. Set up plug-in in your UE4 project.

Set up OAuth 2.0 authentication for Login project in your Publisher Account

1. Go to your Publisher Account.
2. Click Login in the side menu.
3. Click Configure in the Login project pane.
4. Go to the Security block and select the OAuth 2.0 section.
5. Click Add OAuth 2.0.
6. Specify OAuth 2.0 redirect URIs and click Connect.
7. Copy and save the Client ID.

Set up plug-in in your Unreal Engine project

1. Open your UE4 project in Unreal Editor.
2. Go to Settings > Project Settings > Plugins > Xsolla Login.
3. Enable Use OAuth 2.0 option.
4. In the Client ID field, specify Client ID received when setting up OAuth 2.0 in Publisher Account.

The following methods are implemented in Login & Account System plug-in to work with refresh tokens:

• RefreshToken — refreshes the token if it has expired.
• ExchangeAuthenticationCodeToToken — exchanges the user’s authentication code for a valid JWT.

The State parameter found in the RegisterUser, GetSocialAuthenticationUrl, and AuthenticateWithSessionTicket methods is used for additional user verification during OAuth 2.0 authentication. This parameter is used to mitigate possible CSRF attacks.

You can integrate the SDK with your own authorization system. To do this, implement user identification by custom ID (user ID generated on your server) to open an in-game store, make a payment, and manage inventory.

The flow of interaction with Xsolla servers when using your own authorization system:

1. Your client sends an authentication request to your server.
2. Your server authorizes the user and sends a request to the Xsolla server to receive the user JSON Web Token (JWT), passing in the custom ID.
3. Xsolla server returns the user JWT.
4. Your server passes the user JWT to the client.
5. SDK methods use the received user JWT instead of authorization token to open an in-game store, make a payment, and manage inventory.

To use your own authorization system with Xsolla products:

1. Set up server OAuth 2.0 client in your Publisher Account.
2. Implement getting the server JWT.
3. Implement getting the user JWT.
4. Implement the logic of working with the in-game store, purchases, and inventory using the user JWT.

Set up server OAuth 2.0 client

1. Open your project in Publisher Account and go to the Login section.
2. Click Configure in the panel of a Login project.
3. Go to the Security block and select the OAuth 2.0 section.
4. Click Add OAuth 2.0.
5. Specify OAuth 2.0 redirect URIs.
6. Check the Confidential (recommended for server-to-server connection) box.
7. Click Connect.
8. Copy and save the client ID and secret key.

Get server JWT

On the back end of your application, implement a method to get the server JWT using the Generate JWT API call. The request must contain the following parameters:

• grant_type is the JWT type, pass the client_credentials value.
• client_secret is the secret key that is received when you set up the server OAuth 2.0 client.
• client_id is the client ID received when you set up the server OAuth 2.0 client.

Get user JWT

On the back end of your application, implement a method to get the user JWT using the Auth by custom ID API call. The request must contain the X-Server-Authorization: <server_JWT> header, where <server_JWT> is the server JWT obtained in the previous step.

Use user JWT

Use the SDK methods to open the in-game store, make a payment, and manage inventory. While using the SDK methods, pass the user JWT instead of authorization token.

The following tutorials contain examples of using the token:

• Sell virtual items for real currency
• Sell virtual items for virtual currency
• Display of items in inventory
• Display of virtual currency balance

Implement the logic of receiving a new user JWT after its expiration. It is recommended that you get a new token in the background mode, so the user doesn’t have to log in to the application again.

Native authentication allows players to log in to your application via installed applications that use social network accounts. Currently, SDK has implemented native authentication via the following social networks:

• Google
• Facebook

To configure native authentication:

1. Create your UE4 project build for Android.

3. Set up authentication via social networks on the Xsolla side:
   1. For Facebook and Google, set up social connections in Publisher Account.
   2. For WeChat and QQ, contact your Customer Success Manager or email to csm@xsolla.com.
4. Set up the SDK for your Unreal Engine project.
5. Implement authentication logic on the application side.

Set up application page in your Facebook developer account

1. Go to project settings in the Facebook developer account.
2. Go to Settings > Basic.
3. Click Add Platform and select Android.
4. Specify the package name of your Android application in the Google Play Package Name field.
5. Specify a fully qualified class name of the Activity in the Class Name field (default value is com.epicgames.ue4.GameActivity).
6. Generate a hash key and specify it in the Key Hashes field.
7. Click Save Changes.

For further native authentication configuration, you will need App ID and App Secret found in project settings in Settings > Basic section.

Set up project in Google API Console

1. Go to Google API Console.
2. Click New Project.
3. Specify Project name and Location and click Save.
4. Go to the created project and click OAuth consent screen in the side menu.
5. Select External option and click Create.
6. Specify the necessary parameters and click Save.
7. Click Credentials in the side menu.
8. Create an OAuth 2.0 client for your Android app:

1. 1. Click Create credentials and select OAuth client ID.
   2. Specify Android in the Application type field.
   3. Specify Name.
   4. Specify package name of your Android application in the Package name field.
   5. Get the SHA-key.
   6. Specify SHA-key generated in the previous step SHA-key in the SHA-1 certificate fingerprint field.
   7. Click Create.
   8. Click OK.

9. Create an OAuth 2.0 client for the web application:
   1. Click Create credentials and select OAuth client ID.
   2. Specify Web application in the Application type field.
   3. Specify Name.
   4. Click Add URI in the Authorized redirect URIs section and specify https://login.xsolla.com/api/social/oauth2/callback URI.
   5. Click Create.
   6. Click OK.

For further native authentication configuration, you will need Client ID and Client Secret found in settings of the Client ID for the web application.

Set up social connections for Login project in Xsolla Publisher Account

1. Open your project in Publisher Account.
2. Click Login in the side menu and go to Login projects > your Login project > Social connections.
3. To set up authentication via Facebook:

1. 1. Click Edit in the Facebook panel and change status to Disconnected.
   2. Specify the App ID from the Facebook developer account in the Application ID field.
   3. Specify App Secret from the Facebook developer account in the Application Secret field.
   4. Click Connect.

6. To set up authentication via Google:
   1. Click Edit in the Google panel and change status to Disconnected.
   2. Specify the Client ID for a web application from the Google API Console in the Application ID field.
   3. Specify the Client Secret for a web application from the Google API Console in the Application Secret field.
   4. Click Connect.

Set up SDK for Unreal Engine project

1. Go to your UE4 project.
2. Go to Settings > Project Settings > Plugins > Xsolla Login > Xsolla Login Android.
3. Check the Allow Native Auth box.
4. Specify App ID from the Facebook developer in the Facebook App Id field.
5. Specify the Client ID for a web application from the Google API Console in the Google App Id field.

Native authentication allows players to enter your application via the installed Steam client. After setting up native authentication via Steam, you can also add payment via Steam to the application.

To set up native authentication:

1. Set up silent authentication via Steam in Publisher Account.
2. Configure your UE4 project.
3. Configure the processing of events.
4. Ensure authentication via Steam.

Configure your Unreal Engine project

1. Go to the Config catalog of your UE4 project.
2. Add the lines below to the DefaultEngine.ini file and specify your app ID in Steam for the SteamDevAppId parameter.

[/Script/Engine.GameEngine]
+NetDriverDefinitions=(DefName="GameNetDriver",DriverClassName="OnlineSubsystemSteam.SteamNetDriver",DriverClassNameFallback="OnlineSubsystemUtils.IpNetDriver")

[OnlineSubsystem]
DefaultPlatformService=Steam

[OnlineSubsystemSteam]
bEnabled=true
SteamDevAppId=480

[/Script/OnlineSubsystemSteam.SteamNetDriver]
NetConnectionClassName="OnlineSubsystemSteam.SteamNetConnection"

3. Open the project in the Unreal Editor.
4. Go to Settings > Plugins > Online Platform.
5. In the Online Subsystem Steam module, check the Enabled box and click the Restart Now button to save settings and reload the Unreal Editor.

Configure processing of events

1. The image below shows how to add nodes to the project:

To authenticate users via Steam, you should get a session ticket via the GetSessionTicket method. Pass the received value when calling the AuthenticateWithSessionTicket method. As a result, you get the token that is used when calling the API.

2. For additional token validation, add the ValidateToken method callback (optional).

Ensure authentication via Steam

1. Create the build of your UE4 project for a stand-alone platform.
2. Launch Steam and log in.
3. Launch your application. If everything is correct, the Steam pop-up window appears.

Token invalidation allows for improved security of user authentication data in your application. If the option is enabled, a new token replaces the old one that becomes invalid every time the user authenticates.

When using the SDK, invalidation of the existing token and generation of a new one is made by calling Auth by username and password and Auth via social network API calls, if the with_logout parameter has the 1 value.

To enable token invalidation in your UE4 project:

1. Go to Settings > Project Settings > Plugins > Xsolla Login.
2. Enable the Invalidate Existing Sessions option.

You can use Xsolla Launcher to deliver your application to users and update it. The Launcher contains a built-in authorization tool. To avoid the need to re-enter username and password, set up authorization in your application via the Launcher.

Set up SDK and Launcher to work together

1. Set up Launcher in your Publisher Account.

2. Customize the launcher UI.

3. Implement the Launcher authorization logic in your application.
4. Generate a launcher installation file and a build archive.
5. Create an application build.
6. Upload the application build to the Xsolla update server.

Implement logic for authorization via Launcher

The flow for authorization in the application via Launcher is as follows:

1. The user is authorized in the Launcher.
2. The user installs and runs the application.
3. Launcher runs the application and passes user parameters via the command line. The authorization token is passed in the xsolla-login-token parameter.
4. The application processes command line parameters and obtains a token.
5. The application validates the received token.
6. The application automatically authorizes the user without displaying an authorization page.

An example of the implementation of this logic is available in the W_LoginDemo blueprint of the demo project.

Create an application build

1. Go to your UE4 project.
2. In the Content Browser, open the user authorization map where the token is being processed.
3. Go to Edit > Project Settings in the main menu.
4. Go to Project> Maps & Modes and in the Game Default Map field select the previously opened authorization map.

5. Go to Plugins > Xsolla Login.
6. In the Project ID field, specify the Project ID found in Publisher Account > Project settings > Project ID.
7. In the Login ID field, specify the Login ID found in Publisher Account > Launcher > General settings > Authentication.
8. Go to File > Package Project > Windows (64 bit) or to File > Package Project > Mac in the main menu, depending on the platform for which you are creating the build.
9. In the pop-up window, specify the path to the directory where the finished build will be placed.

Device ID authentication lets users start using the application on a mobile device without entering registration data. The first time a user logs in to the application using the device ID, a new account is created automatically, and the user doesn’t need to enter a username, email address, or other data.

With the device ID, you can implement user authentication on one or more mobile devices in the background mode. To use this function, the user should link the device ID to an existing account.

The SDK supports authentication via ID of mobile devices on Android and iOS.

Get device ID

The device ID is generated by the platform and is available to applications installed on the mobile device. The SDK gets the ID value using the platform API and uses this value to perform various functions using the Xsolla API.

The iOS device ID is passed in the UIDevice.identifierForVendor property. The Android device ID is passed in the android.provider.Settings.Secure.ANDROID_ID constant. The standard UE4 Get Device Id method is used to determine the ID.

SDK methods

The SDK implements methods for the following functions:

Authentication

Account upgrade

Device management