Authentication

Learn about advanced setups from our how-tos.

How to set up OAuth 2.0 authentication

OAuth 2.0 uses short-lived tokens with long-term authorization (refresh tokens) instead of long-lived tokens. A refresh token allows users to stay in your application for an extended period of time without needing to re-enter their username and password. This eliminates the risk of compromising user authentication data.

Set up OAuth 2.0 for authorization:

  • via username or email and password
  • via social networks
  • via Steam

If the option is enabled, user registration and authentication is carried out by calling the Register new user and JWT auth by username and password API calls. The Login & Account System plug-in provides the same methods for OAuth 2.0 authorization as for JWT token authorization. In the FXsollaAuthToken structure, the refresh token is specified in the RefreshToken field.

Note
Enabling this setting doesn’t change the authentication process in your application for the user.

To configure OAuth 2.0 authorization:

  1. Set up OAuth 2.0 authentication for Login project in your Publisher Account.
  2. Set up plug-in in your UE4 project.

Set up OAuth 2.0 authentication for Login project in your Publisher Account

  1. Go to your Publisher Account.
  2. Click Open in the Login block and go to Login projects.
  3. Click Open and set up in the Login project block.
  4. Go to General settings > Authorization.
  5. Click Connect in the OAuth 2.0 authentication block.
  6. Specify OAuth 2.0 redirect URIs and click Connect.
  7. Copy and save the Client ID.

Set up plug-in in your UE4 project

  1. Open your UE4 project in Unreal Editor.
  2. Go to Settings > Project Settings > Plugins > Xsolla Login.
  3. Enable Use OAuth 2.0 option.
  4. In the Client ID field, specify Client ID received when setting up OAuth 2.0 in Publisher Account.

The following methods are implemented in Login & Account System plug-in to work with refresh tokens:

  • RefreshToken — refreshes the token if it has expired.
  • ExchangeAuthenticationCodeToToken — exchanges the user’s authentication code for a valid JWT.

The State parameter found in the RegisterUser, GetSocialAuthenticationUrl, and AuthenticateWithSessionTicket methods is used for additional user verification during OAuth 2.0 authentication. This parameter is used to mitigate possible CSRF attacks.

Was this article helpful?
Thank you!
Is there anything we can improve? Message
We’re sorry to hear that
Please explain why this article wasn’t helpful to you. Message
Thank you for your feedback!
We’ll review your message and use it to help us improve your experience.
Hide

How to use your own login system

Notice
Use this how-to when working only with the following plug-ins:
  • Game Commerce
  • Cross-Buy

You can integrate Game Commerce and Cross-Buy plug-ins with your own login system. To do this, implement user authentication in your application via Pay Station access token.

The flow of interaction with Xsolla servers when using your own authorization system:

  1. Your client sends an authentication request to your server.
  2. Your server authorizes the user and sends a request to the Xsolla server to receive the Pay Station access token.
  3. Xsolla server returns the Pay Station access token.
  4. Your server passes the Pay Station access token to the client.
  5. SDK methods use the received Pay Station access token as an authorization token to open an in-game store, make a payment, and manage inventory.

Get Pay Station access token

Note
If you use the PlayFab or Firebase authorization system, get the Pay Station access token using Xsolla ready-made extensions for BaaS.

On the back end of your application, implement a method to obtain a Pay Station access token using an HTTP POST request.

Xsolla API uses basic HTTP authentication. The request must contain the Authorization: Basic <your_authorization_basic_key> header, where <your_authorization_basic_key> is the merchant_id:api_key encoded according to the Base64 standard. You can find the parameter values in Publisher Account:

  • for merchant_id, go to the Project settings > Webhooks > Merchant ID section.
  • for api_key, go to the Company settings > API key section.

HTTP request:

Copy
Full screen
Small screen
POST https://api.xsolla.com/merchant/v2/merchants/{merchant_id}/token

To get the token, pass the following parameters in the request body:

ParameterTypeDescription
settings
objectCustom project settings (object).
settings.project_id
integerGame’s Xsolla ID. Can be found in Publisher Account beside the name of your project. Required.
user
objectUser details (object).
user.id
objectUser ID in your authorization system (object).
user.id.value
stringUser ID. Required.
user.email
objectUser email (object).
user.email.value
stringUser email. Must be valid according to the RFC 822 protocol. Required.
user.name
objectUser screen name (object). Required.
user.name.value
stringUser screen name
user.steam_id
objectUser Steam ID (object).
user.steam_id.value
stringUser Steam ID. Required if the application is published on Steam.
user.playfab_id
objectUser PlayFab ID (object)
user.playfab_id.value
stringUser PlayFab ID. Required if the application uses PlayFab services to grant items.

See examples of requests and responses in the API reference.

Note
In the request, use only parameters from the list above. Don’t pass other parameters of the API call (custom_parameters, purchase, etc.), they are not intended to receive an authorization token.

Use Pay Station access token

To use the Pay Station access token to open an in-game store, make a payment, and manage inventory, pass it to the SDK methods.

See examples of using the authorization token in the tutorials:

Implement the logic of receiving a new Pay Station access token after its expiration. It is recommended that you get a new token in the background mode, so the user doesn’t have to log in to the application again.

Note
The lifetime of the Pay Station access token when working with the in-game store and inventory is 1 hour after the last call to the Xsolla API. To change the lifetime of the Pay Station access token, contact your Account Manager.
Was this article helpful?
Thank you!
Is there anything we can improve? Message
We’re sorry to hear that
Please explain why this article wasn’t helpful to you. Message
Thank you for your feedback!
We’ll review your message and use it to help us improve your experience.
Hide

How to set up native authentication via social networks

Native authentication allows players to log in to your application via installed applications that use social network accounts. Currently, SDK has implemented native authentication via the following social networks:

  • Google
  • Facebook

Note
Native authentication via social networks is available in:
  • Game Commerce plug-in version 0.5.7 and higher for UE4
  • Login & Account System plug-in version 0.3.0 and higher for UE4
  • Cross-Buy plug-in version 0.3.0 and higher for UE4

To configure native authentication:

  1. Create your UE4 project build for Android.

Note
For further native authentication configuration you will need the package name of your Android application found in the Edit > Project Settings > Platforms > Android section in the Android Package Name ('com.YourCompany.Project' [PROJECT] is replaced with project name) field.

  1. For native authentication via Facebook, create your Facebook developer account and a new application.
  2. Set up the application page in your Facebook developer account.
  3. For native authentication via Google, set up the project in Google API Console.
  4. Set up social connections for the Login project in Publisher Account.
  5. Set up the plug-in for your UE4 project.

Set up application page in your Facebook developer account

  1. Go to project settings in the Facebook developer account.
  2. Go to Settings > Basic.
  3. Click Add Platform and select Android.
  4. Specify the package name of your Android application in the Google Play Package Name field.
  5. Specify a fully qualified class name of the Activity in the Class Name field (default value is com.epicgames.ue4.GameActivity).
  6. Generate a hash key and specify it in the Key Hashes field.
  7. Click Save Changes.

For further native authentication configuration, you will need App ID and App Secret found in project settings in Settings > Basic section.

Set up project in Google API Console

  1. Go to Google API Console.
  2. Click New Project.
  3. Specify Project name and Location and click Save.
  4. Go to the created project and click OAuth consent screen in the side menu.
  5. Select External option and click Create.
  6. Specify the necessary parameters and click Save.
  7. Click Credentials in the side menu.
  8. Create an OAuth 2.0 client for your Android app:

    1. Click Create credentials and select OAuth client ID.
    2. Specify Android in the Application type field.
    3. Specify Name.
    4. Specify package name of your Android application in the Package name field.
    5. Get the SHA-key.
    6. Specify SHA-key generated in the previous step SHA-key in the SHA-1 certificate fingerprint field.
    7. Click Create.
    8. Click OK.

  1. Create an OAuth 2.0 client for the web application:
    1. Click Create credentials and select OAuth client ID.
    2. Specify Web application in the Application type field.
    3. Specify Name.
    4. Click Add URI in the Authorized redirect URIs section and specify https://login.xsolla.com/api/social/oauth2/callback URI.
    5. Click Create.
    6. Click OK.

For further native authentication configuration, you will need Client ID and Client Secret found in settings of the Client ID for the web application.

Set up social connections for Login project in Xsolla Publisher Account

  1. Open your project in Publisher Account.
  2. Click Login in the side menu and go to Login projects > your Login project > Social connections.
  3. To set up authentication via Facebook:

    1. Click Edit in the Facebook panel and change status to Disconnected.
    2. Specify the App ID from the Facebook developer account in the Application ID field.
    3. Specify App Secret from the Facebook developer account in the Application Secret field.
    4. Click Connect.

  1. To set up authentication via Google:
    1. Click Edit in the Google panel and change status to Disconnected.
    2. Specify the Client ID for a web application from the Google API Console in the Application ID field.
    3. Specify the Client Secret for a web application from the Google API Console in the Application Secret field.
    4. Click Connect.

Set up plugin for UE4 project

  1. Go to your UE4 project.
  2. Go to Settings > Project Settings > Plugins > Xsolla Login > Xsolla Login Android.
  3. Check the Allow Native Auth box.
  4. Specify App ID from the Facebook developer in the Facebook App Id field.
  5. Specify the Client ID for a web application from the Google API Console in the Google App Id field.

Was this article helpful?
Thank you!
Is there anything we can improve? Message
We’re sorry to hear that
Please explain why this article wasn’t helpful to you. Message
Thank you for your feedback!
We’ll review your message and use it to help us improve your experience.
Hide

How to set up native authentication via Steam

Native authentication allows players to enter your application via the installed Steam client. After setting up native authentication via Steam, you can also add payment via Steam to the application.

To set up native authentication:

  1. Set up silent authentication via Steam in Publisher Account.
  2. Configure your UE4 project.
  3. Configure the processing of events.
  4. Ensure authentication via Steam.

Configure your UE4 project

  1. Go to the Config catalog of your UE4 project.
  2. Add the lines below to the DefaultEngine.ini file and specify your app ID in Steam for the SteamDevAppId parameter.

Copy
Full screen
Small screen
    [/Script/Engine.GameEngine]
    +NetDriverDefinitions=(DefName="GameNetDriver",DriverClassName="OnlineSubsystemSteam.SteamNetDriver",DriverClassNameFallback="OnlineSubsystemUtils.IpNetDriver")
    
    [OnlineSubsystem]
    DefaultPlatformService=Steam
    
    [OnlineSubsystemSteam]
    bEnabled=true
    SteamDevAppId=480
    
    [/Script/OnlineSubsystemSteam.SteamNetDriver]
    NetConnectionClassName="OnlineSubsystemSteam.SteamNetConnection"

    1. Open the project in the Unreal Editor.
    2. Go to Settings > Plugins > Online Platform.
    3. In the Online Subsystem Steam module, check the Enabled box and click the Restart Now button to save settings and reload the Unreal Editor.

    Configure processing of events

    1. The image below shows how to add nodes to the project:

      To authenticate users via Steam, you should get a session ticket via the GetSessionTicket method. Pass the received value when calling the AuthenticateWithSessionTicket method. As a result, you get the token that is used when calling the API.

    1. For additional token validation, add the ValidateToken method callback (optional).

    Ensure authentication via Steam

    1. Create the build of your UE4 project for a stand-alone platform.
    2. Launch Steam and log in.
    3. Launch your application. If everything is correct, the Steam pop-up window appears.

    Was this article helpful?
    Thank you!
    Is there anything we can improve? Message
    We’re sorry to hear that
    Please explain why this article wasn’t helpful to you. Message
    Thank you for your feedback!
    We’ll review your message and use it to help us improve your experience.
    Hide

    How to set up token invalidation

    Token invalidation allows for improved security of user authentication data in your application. If the option is enabled, a new token replaces the old one that becomes invalid every time the user authenticates.

    Note
    You can configure token invalidation for authentication that uses a JWT token. For OAuth 2.0 authentication, token invalidation is provided by the protocol itself and does not need to be configured separately.

    When using the SDK, invalidation of the existing token and generation of a new one is made by calling Auth by username and password and Auth via social network API calls, if the with_logout parameter has the 1 value.

    To enable token invalidation in your UE4 project:

    1. Go to Settings > Project Settings > Plugins > Xsolla Login.
    2. Enable the Invalidate Existing Sessions option.

    Was this article helpful?
    Thank you!
    Is there anything we can improve? Message
    We’re sorry to hear that
    Please explain why this article wasn’t helpful to you. Message
    Thank you for your feedback!
    We’ll review your message and use it to help us improve your experience.
    Hide

    How to set up authorization in application via Launcher

    You can use Xsolla Launcher to deliver your application to users and update it. The Launcher contains a built-in authorization tool. To avoid the need to re-enter username and password, set up authorization in your application via the Launcher.

    Notice
    To use the Launcher, you need to configure Login. Using a different authorization system is not supported.

    Set up SDK and Launcher to work together

    1. Set up Launcher in your Publisher Account.

    Note
    In the config.json file, it is enough to change the values ​​for the following objects:
    • launcher_project_id — specify Launcher ID found in Publisher Account > Launcher > General settings > General info
    • login_project_id — specify Login ID found in Publisher Account > Launcher > General settings > Authentication

    1. Customize the launcher UI.

    Notice
    SDKs integration with Xsolla servers uses Commerce API calls, so the Launcher store is not supported.

    1. Implement the Launcher authorization logic in your application.
    2. Generate a launcher installation file and a build archive.
    3. Create an application build.
    4. Upload the application build to the Xsolla update server.

    Implement logic for authorization via Launcher

    The flow for authorization in the application via Launcher is as follows:

    1. The user is authorized in the Launcher.
    2. The user installs and runs the application.
    3. Launcher runs the application and passes user parameters via the command line. The authorization token is passed in the xsolla-login-token parameter.
    4. The application processes command line parameters and obtains a token.
    5. The application validates the received token.
    6. The application automatically authorizes the user without displaying an authorization page.

    An example of the implementation of this logic is available in the W_LoginDemo blueprint of the demo project.

    Note
    The obtained token is used by SDK methods to open an in-game store, make a payment, etc.

    Create an application build

    1. Go to your UE4 project.
    2. In the Content Browser, open the user authorization map where the token is being processed.
    3. Go to Edit > Project Settings in the main menu.
    4. Go to Project> Maps & Modes and in the Game Default Map field select the previously opened authorization map.

    1. Go to Plugins > Xsolla Login.
    2. In the Project ID field, specify the Project ID found in Publisher Account > Project settings > Project ID.
    3. In the Login ID field, specify the Login ID found in Publisher Account > Launcher > General settings > Authentication.
    4. Go to File > Package Project > Windows (64 bit) or to File > Package Project > Mac in the main menu, depending on the platform for which you are creating the build.
    5. In the pop-up window, specify the path to the directory where the finished build will be placed.

    Was this article helpful?
    Thank you!
    Is there anything we can improve? Message
    We’re sorry to hear that
    Please explain why this article wasn’t helpful to you. Message
    Thank you for your feedback!
    We’ll review your message and use it to help us improve your experience.
    Hide
    Last updated: July 30, 2021

    Found a typo or other text error? Select the text and press Ctrl+Enter.

    Report a problem
    We always review our content. Your feedback helps us improve it.
    Provide an email so we can follow up
    Thank you for your feedback!