Documentation

Cloud Code

Open Unity Dashboard

Cloud Code

Access control in CloudBehaviours

Restrict which callers are allowed to invoke a CloudBehaviour endpoint.
Read time 2 minutesLast updated 14 days ago
Important
This page describes an experimental feature that might change significantly before release. It's not recommended to use or rely on experimental features in production environments due to potential instability.
Every CloudBehaviour endpoint has an access level. By default, Cloud Code resolves it from the class's 
[StateScope]
: a 
Scope.Player
class defaults to 
Access.Player
, and a 
Scope.MultiplayerSession
class defaults to 
Access.SessionMember
. Add 
[CloudCodeAccess]
only where a specific endpoint needs to differ from that default:
[StateScope(Scope.MultiplayerSession)]public class MatchState : CloudBehaviour{    public void SubmitMove(string move) { }                   // Access.SessionMember (default)    [CloudCodeAccess(Access.SessionHost)]    public void StartMatch() { }                               // Only the session host    [CloudCodeAccess(Access.Service)]    public void GrantReward(string playerId, int amount) { }   // Only service-token callers}

The Access enum

Which values are valid depends on the class's 
[StateScope]
:

Value

Valid on

Who can call

Unspecified
Any scopeResolves from the class scope at load time (the default): 
Access.Player
for 
Scope.Player
, 
Access.SessionMember
for 
Scope.MultiplayerSession
Global
Any scopeAny authenticated caller
Service
Any scopeNon-player callers only, such as other CloudBehaviours, service accounts, or trusted backends. Never a player.
Player
Scope.Player
only		The player who owns the scope, and any non-player caller
SessionMember
Scope.MultiplayerSession
only		Any member of the session, and any non-player caller
SessionHost
Scope.MultiplayerSession
only		The host of the session, and any non-player caller
An 
Access
value that a class's scope can't support throws when the module loads.

Choose a level

Use 
Access.Service
on anything that mints value, such as granting currency or awarding items. Use 
SessionHost
for match flow control, such as starting or force-advancing a match, where one client is authoritative. Beyond those cases, the scope's default access level is usually correct.
Important
Access control restricts who can call an endpoint, but not who receives the changes the endpoint makes. When any endpoint changes synchronized state, the new state reaches every client in the scope. For example, clients can't call an 
Access.Service
endpoint, but they still receive the synchronized state that the endpoint changes. To keep data private, use a private field, or refer to Per-player state views in CloudBehaviours.

Additional resources