# Authentication

> Authenticate Cloud Code requests with player identities.

Cloud Code only accepts authenticated requests.

Authentication allows you to use a player's identity to ensure security, consistency, and safety with every interaction in your game.

To authenticate with Cloud code, you can use the authentication methods below:

| Request origin                                                   | Authentication method                                                                             |
| ---------------------------------------------------------------- | ------------------------------------------------------------------------------------------------- |
| Untrusted client (player)                                        | Use the [Unity Authentication](/authentication.md) service.                                       |
| Trusted client (game server, integration testing, local machine) | Use [service account authentication](https://services.docs.unity.com/docs/service-account-auth/). |

## Authenticate players

[Unity Authentication](/authentication.md) assigns unique identifiers to players and provides a variety of authentication methods.

> **Note:**
>
> You can use Unity Authentication for anonymous authentication and external authentication solutions for supported platforms, including mobile and PC. Refer to [Approaches to authentication](/authentication/approaches-to-authentication.md) for more details.

Cloud Code scripts provide a `context` object which contains an `accessToken` property. This access token is the [JWT](https://jwt.io/introduction) that you use to authenticate the player that calls the script.

For more information about how to use the `accessToken` in your script, refer to the [Access token support](./token-support.md#access-token-support) documentation.

### Restrict access

If you want to restrict access to specific scripts, you can use Role-based Access Control (RBAC) rules.

These rules allow you to ensure that players can't run special scripts, such as single-use support scripts that grant players additional resources. For more information, refer to the [Access Control](./access-control.md) documentation.

> **Note:**
>
> For security, you can only use JWTs that the Unity Authentication service generates with the [Cloud Code Client API](https://services.docs.unity.com/cloud-code/v1/index.html#tag/cloud-code). The Cloud Code service rejects these calls if you make them to the [Cloud Code Admin API](https://services.docs.unity.com/cloud-code-admin/v1/#tag/cloud-code-modules).

## Authenticate trusted clients

You can use both the Client and Admin Cloud Code APIs with [Service Account Authentication](https://services.docs.unity.com/docs/service-account-auth/).

This opens up a variety ways that you can use Cloud Code:

* Write scripts from your local machine.
* Write and run scripts from a CI/CD pipeline.
* Run scripts from a game server.
* Run scripts in integration tests.

You can use Service Accounts for both Bearer (JWT) and Basic authentication. For more information, check the [Service Account Authentication](https://services.docs.unity.com/docs/service-account-auth/) documentation.

### Cloud Code Admin API (Basic Authentication)

To access the [Cloud Code Admin API](https://services.docs.unity.com/cloud-code-admin/v1/#tag/cloud-code-scripts), use [Basic authentication](https://services.docs.unity.com/docs/service-account-auth/#authenticate-an-api-using-service-account-credentials).

To use the Service Account credentials directly, base64 encode the `<KEY_ID>:<SECRET_KEY>`. You also need to grant the service account the appropriate permissions. For more information on permissions and roles in Cloud Code, refer to the table below.

| Access rights             | Role                                                                                                           |
| ------------------------- | -------------------------------------------------------------------------------------------------------------- |
| Read scripts              | [Cloud Code Viewer](https://services.docs.unity.com/docs/service-account-auth/#cloud-code-viewer)              |
| Read/Write/Delete scripts | [Cloud Code Editor](https://services.docs.unity.com/docs/service-account-auth/#cloud-code-editor)              |
| Publish scripts           | [Cloud Code Publisher](https://services.docs.unity.com/docs/service-account-auth/#cloud-code-script-publisher) |

### Cloud Code Client API (Bearer Authentication)

To access the [Cloud Code Client API](https://services.docs.unity.com/cloud-code/v1/index.html#tag/cloud-code), use Bearer auth with [Token Exchange API](https://services.docs.unity.com/auth/v1/#tag/authentication/operation/exchangetostateless) to obtain a stateless token with a limited lifespan.

> **Note:**
>
> Although the Token Exchange API states that the query parameter for the environment ID is optional, you must provide it to access the Cloud Code Client API for running scripts.

To [refresh the token](https://services.docs.unity.com/docs/service-account-auth/#refresh-your-stateless-token) when it expires, you can use the same API.

Cloud Code scripts provide a `context` object which contains an `serviceToken` property. The `serviceToken` property is a [JWT](https://jwt.io/introduction) that you can use to authenticate as Cloud Code and access cross-player data. For example, you can use this token to make calls to Cloud Save to save data on behalf of another player.

For more information about how to use the `serviceToken` in your script, refer to the [Service token support](./token-support.md#service-token-support) documentation.

> **Note:**
>
> You can only use the Token Exchange API to call out to the Client API. You don't need to specify any scopes in the request.