Documentation

Player Authentication Client API

Player Authentication Client API

Player Authentication Client API

Introduction

Sign players in to Unity Authentication, refresh their sessions, and manage their sign-in methods. The ID token returned on sign-in is the player's credential for most other Unity Gaming Services APIs.

Rate Limits

The API has rate limiting in place. Most endpoints are limited to 15 requests per second and 600 requests per hour on a per-IP basis, shared across those endpoints. Exceptions are noted on the affected endpoints. The API responds with a 
429
HTTP status code if a rate limit is exceeded, and a 
Retry-After
header with the number of seconds until requests are accepted again.
Download OpenAPI specification:

Anonymous Sign Up

Sign-up a new anonymous player.
Authorizations
Client
HTTP: Client
HTTP Authorization Scheme: bearer

Header parameters for "Anonymous Sign Up"

ProjectId

string
required
example: 8bdacc33-6eef-4577-beb0-633c86259f5b
This is the Unity Project Id. It is a uuid format.

UnityEnvironment

string
example: production
This is the Environment you want to authorize a player to access. It is the name of the Environment. If this header is not specified, then the default Environment is used. An invalid environment name is not an acceptable input.

Request body for "Anonymous Sign Up"

Media Type:
application/json

nonce

string
example: 9i09urd6ffg
String value used to associate a client session with an Id Token, and to mitigate replay attacks. If this field is provided, the nonce claim in response id token has a matching value.

HTTP response status codes for "Anonymous Sign Up":

Code samples for "Anonymous Sign Up":

Request example

curl -X POST \ -H "Authorization: Bearer <YOUR_TOKEN>" \ -H "Content-Type: application/json" \ -d '{ "nonce": "9i09urd6ffg"}' \ "https://player-auth.services.api.unity.com/v1/authentication/anonymous"

Response example

{ "expiresIn": 3600, "idToken": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c", "sessionToken": "5eb26a338a232", "lastNotificationDate": "123000000", "user": { "disabled": false, "externalIds": [ { "externalId": "5eb26a338a232", "providerId": "provider-id" } ], "id": "eyJhbGciOiJIUzI1", "username": "New_User_57" }, "userId": "5eb26a338a232"}

Session Token Sign In

Authenticate players using the session token. Store the session token in a persistent storage in the app or on device.
Set 
singleUse
, 
audiences
or 
ttlSeconds
to receive a new, restricted child session token instead, for handing to a less-trusted context such as a browser. The presented token stays valid unless it is single-use. Restrictions on the child session token are inherited by every later refresh and never loosened, except by an Origin policy (see 
narrowOnly
).
Authorizations
Client
HTTP: Client
HTTP Authorization Scheme: bearer

Header parameters for "Session Token Sign In"

ProjectId

string
required
example: 8bdacc33-6eef-4577-beb0-633c86259f5b
This is the Unity Project Id. It is a uuid format.

UnityEnvironment

string
example: production
This is the Environment you want to authorize a player to access. It is the name of the Environment. If this header is not specified, then the default Environment is used. An invalid environment name is not an acceptable input.

Request body for "Session Token Sign In"

Media Type:
application/json

nonce

string
example: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpX
String value used to associate a Client session with an Id Token, and to mitigate replay attacks. If this field is provided, the nonce claim in response Id token has a matching value.

sessionToken

string
required
example: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpX
The session token of the player.

singleUse

boolean
example: true
Make the child session token single-use, so its first refresh consumes it. Inherited, and cannot be cleared by a later refresh.

audiences

array[string]
example: ["cloud-save","leaderboards"]
Scope the child session token to these services. Each entry adds 
svc:<name>
to the ID token's 
aud
, and audience-checked routes outside the set reject it. A service's name is a segment of its production URL, e.g. 
cloud-save
for 
cloud-save.services.api.unity.com
. Ignored if the presented token is already scoped. 
player-auth
gates this API's player-management routes (Get and Delete Player, link, unlink, username/password sign-up and password change, code-link confirm, notifications), not sign-in or refresh.

ttlSeconds

integer
example: 60
Expire the child session token after this many seconds, capped at the presented token's expiry.

narrowOnly

boolean
example: true
Stop Origin policies from widening this token's restrictions. Some Unity web origins apply their own restrictions on the first refresh from them, by default replacing the session token's audiences and expiry, which can widen them. With 
narrowOnly
, the policy's audiences are intersected with the token's and its expiry applies only if sooner. It still adds single-use and binds the session token to the origin. Fields left unset take the policy's value. If the token's audiences share none with the policy's, that refresh is rejected. Inherited, and cannot be cleared by a later refresh.

HTTP response status codes for "Session Token Sign In":

Code samples for "Session Token Sign In":

Request example

curl -X POST \ -H "Authorization: Bearer <YOUR_TOKEN>" \ -H "Content-Type: application/json" \ -d '{ "nonce": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpX", "sessionToken": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpX", "singleUse": true, "audiences": [ "cloud-save", "leaderboards" ], "ttlSeconds": 60, "narrowOnly": true}' \ "https://player-auth.services.api.unity.com/v1/authentication/session-token"

Response example

{ "expiresIn": 3600, "idToken": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c", "sessionToken": "5eb26a338a232", "lastNotificationDate": "123000000", "user": { "disabled": false, "externalIds": [ { "externalId": "5eb26a338a232", "providerId": "provider-id" } ], "id": "eyJhbGciOiJIUzI1", "username": "New_User_57" }, "userId": "5eb26a338a232"}

External Token Sign In

Authenticate players using external token. The external tokens are from login providers, such as Facebook.
Authorizations
Client
HTTP: Client
HTTP Authorization Scheme: bearer

Path parameters for "External Token Sign In"

idProvider

string
required
example: identity-provider-name
This is the id provider type.

Header parameters for "External Token Sign In"

ProjectId

string
required
example: 8bdacc33-6eef-4577-beb0-633c86259f5b
This is the Unity Project Id. It is a uuid format.

UnityEnvironment

string
example: production
This is the Environment you want to authorize a player to access. It is the name of the Environment. If this header is not specified, then the default Environment is used. An invalid environment name is not an acceptable input.

Request body for "External Token Sign In"

Media Type:
application/json

nonce

string
example: 5eb26a338a232
String value used to associate a client session with an Id token, and to mitigate replay attacks. If this field is provided, the nonce claim in response Id token has a matching value.

signInOnly

boolean
example: false
Whether the API should only attempt to sign-in and do not create a new player if the player does not exist.

token

string
required
example: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpX
External token that can be verified to represent a player from the id provider. This may be an id token or an access token.

oculusConfig

object
The request body for Oculus authentication. This field is not applicable for any other Id provider.

userId

string
required
example: 5eb26a338a232
String value of the oculus player's Id.

appleGameCenterConfig

object
The request body for Apple Game Center authentication. This field is not applicable for any other Id provider.

teamPlayerId

string
required
example: 5eb26a338a232
String value of the Apple Game Center player's team player Id.

timestamp

integer
required
example: 389743847
Integer value of the timestamp.

publicKeyUrl

string
required
example: something.com/path.cert
String value of the Apple Game Center public key url.

salt

string
required
example: ascfr==
String value of the base64 encoded salt.

steamConfig

Identifying string passed as a parameter to Steam's GetAuthTicketForWebApi when the ticket was created, used to identify the entity calling this webapi. This should not be sent if no identity was passed issue a ticket from steam.

HTTP response status codes for "External Token Sign In":

Code samples for "External Token Sign In":

Request example

curl -X POST \ -H "Authorization: Bearer <YOUR_TOKEN>" \ -H "Content-Type: application/json" \ -d '{ "nonce": "5eb26a338a232", "signInOnly": false, "token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpX", "oculusConfig": { "userId": "5eb26a338a232" }, "appleGameCenterConfig": { "teamPlayerId": "5eb26a338a232", "timestamp": 389743847, "publicKeyUrl": "something.com/path.cert", "salt": "ascfr==" }, "steamConfig": { "appId": "123456", "identity": "string" }}' \ "https://player-auth.services.api.unity.com/v1/authentication/external-token/{idProvider}"

Response example

{ "expiresIn": 3600, "idToken": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c", "sessionToken": "5eb26a338a232", "lastNotificationDate": "123000000", "user": { "disabled": false, "externalIds": [ { "externalId": "5eb26a338a232", "providerId": "provider-id" } ], "id": "eyJhbGciOiJIUzI1", "username": "New_User_57" }, "userId": "5eb26a338a232"}

Link External Id

Link an external ID to a Unity Authentication player.
Authorizations
Client
HTTP: Client
HTTP Authorization Scheme: bearer

Path parameters for "Link External Id"

idProvider

string
required
example: identity-provider-name
This is the id provider type.

Header parameters for "Link External Id"

ProjectId

string
required
example: 8bdacc33-6eef-4577-beb0-633c86259f5b
This is the Unity Project Id. It is a uuid format.

Authorization

string
example: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c
This is the bearer token for the user authorized to call this API.

Request body for "Link External Id"

Media Type:
application/json

forceLink

boolean
example: false
Force a link between the player specified in the player-auth access token and the external Id. If a different player-auth player is already linked to the external id, unlink that player from the external id before linking the request's player.

token

string
required
example: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpX
External token that can be verified to represent a player from the Id provider. This may be an Id token or an access token.

oculusConfig

object
The request body for Oculus authentication. This field is not applicable for any other Id provider.

userId

string
required
example: 5eb26a338a232
String value of the oculus player's Id.

appleGameCenterConfig

object
The request body for Apple Game Center authentication. This field is not applicable for any other Id provider.

teamPlayerId

string
required
example: 5eb26a338a232
String value of the Apple Game Center player's team player Id.

timestamp

integer
required
example: 389743847
Integer value of the timestamp.

publicKeyUrl

string
required
example: something.com/path.cert
String value of the Apple Game Center public key url.

salt

string
required
example: ascfr==
String value of the base64 encoded salt.

steamConfig

Identifying string passed as a parameter to Steam's GetAuthTicketForWebApi when the ticket was created, used to identify the entity calling this webapi. This should not be sent if no identity was passed issue a ticket from steam.

HTTP response status codes for "Link External Id":

Code samples for "Link External Id":

Request example

curl -X POST \ -H "Authorization: Bearer <YOUR_TOKEN>" \ -H "Content-Type: application/json" \ -d '{ "forceLink": false, "token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpX", "oculusConfig": { "userId": "5eb26a338a232" }, "appleGameCenterConfig": { "teamPlayerId": "5eb26a338a232", "timestamp": 389743847, "publicKeyUrl": "something.com/path.cert", "salt": "ascfr==" }, "steamConfig": { "appId": "123456", "identity": "string" }}' \ "https://player-auth.services.api.unity.com/v1/authentication/link/{idProvider}"

Response example

{ "user": { "disabled": false, "externalIds": [ { "externalId": "5eb26a338a232", "providerId": "provider-id" } ], "id": "eyJhbGciOiJIUzI1", "username": "New_User_57" }, "userId": "5eb26a338a232"}

Unlink External Id

Unlink an external ID from a Unity Authentication player.
Authorizations
Client
HTTP: Client
HTTP Authorization Scheme: bearer

Path parameters for "Unlink External Id"

idProvider

string
required
example: identity-provider-name
This is the id provider type.

Header parameters for "Unlink External Id"

ProjectId

string
required
example: 8bdacc33-6eef-4577-beb0-633c86259f5b
This is the Unity Project Id. It is a uuid format.

Authorization

string
example: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c
This is the bearer token for the user authorized to call this API.

Request body for "Unlink External Id"

Media Type:
application/json

externalId

string
required
example: eyJhbGciOiJIUzI1Ni
The external ID to unlink from the player.

HTTP response status codes for "Unlink External Id":

Code samples for "Unlink External Id":

Request example

curl -X POST \ -H "Authorization: Bearer <YOUR_TOKEN>" \ -H "Content-Type: application/json" \ -d '{ "externalId": "eyJhbGciOiJIUzI1Ni"}' \ "https://player-auth.services.api.unity.com/v1/authentication/unlink/{idProvider}"

Response example

{ "user": { "disabled": false, "externalIds": [ { "externalId": "5eb26a338a232", "providerId": "provider-id" } ], "id": "eyJhbGciOiJIUzI1", "username": "New_User_57" }, "userId": "5eb26a338a232"}

Get Player

Get the information for a player.
Authorizations
Client
HTTP: Client
HTTP Authorization Scheme: bearer

Path parameters for "Get Player"

PlayerId

string
required
example: 99i9ju8juh
This is the player id.

Header parameters for "Get Player"

ProjectId

string
required
example: 8bdacc33-6eef-4577-beb0-633c86259f5b
This is the Unity Project Id. It is a uuid format.

Authorization

string
example: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c
This is the bearer token for the user authorized to call this API.

HTTP response status codes for "Get Player":

Code samples for "Get Player":

Request example

curl -X GET \ -H "Authorization: Bearer <YOUR_TOKEN>" \ "https://player-auth.services.api.unity.com/v1/users/{PlayerId}"

Response example

{ "disabled": false, "externalIds": [ { "externalId": "5eb26a338a232", "providerId": "provider-id" } ], "id": "eyJhbGciOiJIUzI1N", "createdAt": "123000000", "lastLoginAt": "123000000", "usernamepassword": { "username": "New_User_57", "createdAt": "123000000", "lastLoginAt": "123000000", "passwordUpdatedAt": "123000000" }}

Delete Player

Delete the player.
Authorizations
Client
HTTP: Client
HTTP Authorization Scheme: bearer

Path parameters for "Delete Player"

PlayerId

string
required
example: 99i9ju8juh
This is the player id.

Header parameters for "Delete Player"

ProjectId

string
required
example: 8bdacc33-6eef-4577-beb0-633c86259f5b
This is the Unity Project Id. It is a uuid format.

Authorization

string
example: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c
This is the bearer token for the user authorized to call this API.

HTTP response status codes for "Delete Player":

Code samples for "Delete Player":

Request example

curl -X DELETE \ -H "Authorization: Bearer <YOUR_TOKEN>" \ "https://player-auth.services.api.unity.com/v1/users/{PlayerId}"

Response example

{ "title": "Bad Request", "status": 400, "detail": "Something is wrong", "details": [ { "code": "ERROR_CODE_123", "path": "nested.value", "message": "Invalid value" } ]}

Username Password Sign In

Sign in using the Username Password IdProvider. Store the session token in a persistent storage in the app or on device.
Authorizations
Client
HTTP: Client
HTTP Authorization Scheme: bearer

Header parameters for "Username Password Sign In"

ProjectId

string
required
example: 8bdacc33-6eef-4577-beb0-633c86259f5b
This is the Unity Project Id. It is a uuid format.

UnityEnvironment

string
example: production
This is the Environment you want to authorize a player to access. It is the name of the Environment. If this header is not specified, then the default Environment is used. An invalid environment name is not an acceptable input.

Request body for "Username Password Sign In"

Media Type:
application/json

username

string
required
example: New_User_57
The username. Case insensitive. Length must be between 3-20 with the allowed characters a-z, 0-9 and the symbols [.][-][@][_].

password

string
required
example: ThePassword123!
The password. Length must be between 8-30 and contain at least one uppercase letter, at least one lowercase letter, at least one number and at least one symbol.

HTTP response status codes for "Username Password Sign In":

Code samples for "Username Password Sign In":

Request example

curl -X POST \ -H "Authorization: Bearer <YOUR_TOKEN>" \ -H "Content-Type: application/json" \ -d '{ "username": "New_User_57", "password": "ThePassword123!"}' \ "https://player-auth.services.api.unity.com/v1/authentication/usernamepassword/sign-in"

Response example

{ "expiresIn": 3600, "idToken": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c", "sessionToken": "5eb26a338a232", "lastNotificationDate": "123000000", "user": { "disabled": false, "externalIds": [ { "externalId": "5eb26a338a232", "providerId": "provider-id" } ], "id": "eyJhbGciOiJIUzI1", "username": "New_User_57" }, "userId": "5eb26a338a232"}

Username Password Sign Up

Create a new player for the Username Password IdProvider. Store the session token in a persistent storage in the app or on device.
Authorizations
Client
HTTP: Client
HTTP Authorization Scheme: bearer

Header parameters for "Username Password Sign Up"

ProjectId

string
required
example: 8bdacc33-6eef-4577-beb0-633c86259f5b
This is the Unity Project Id. It is a uuid format.

UnityEnvironment

string
example: production
This is the Environment you want to authorize a player to access. It is the name of the Environment. If this header is not specified, then the default Environment is used. An invalid environment name is not an acceptable input.

Authorization

string
example: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c
This is the bearer token for the user authorized to call this API. When this is provided, a user associated with the bearer token is used instead of creating a new user.

Request body for "Username Password Sign Up"

Media Type:
application/json

username

string
required
example: New_User_57
The username. Case insensitive. Length must be between 3-20 with the allowed characters a-z, 0-9 and the symbols [.][-][@][_].

password

string
required
example: ThePassword123!
The password. Length must be between 8-30 and contain at least one uppercase letter, at least one lowercase letter, at least one number and at least one symbol.

HTTP response status codes for "Username Password Sign Up":

Code samples for "Username Password Sign Up":

Request example

curl -X POST \ -H "Authorization: Bearer <YOUR_TOKEN>" \ -H "Content-Type: application/json" \ -d '{ "username": "New_User_57", "password": "ThePassword123!"}' \ "https://player-auth.services.api.unity.com/v1/authentication/usernamepassword/sign-up"

Response example

{ "expiresIn": 3600, "idToken": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c", "sessionToken": "5eb26a338a232", "lastNotificationDate": "123000000", "user": { "disabled": false, "externalIds": [ { "externalId": "5eb26a338a232", "providerId": "provider-id" } ], "id": "eyJhbGciOiJIUzI1", "username": "New_User_57" }, "userId": "5eb26a338a232"}

Username Password Update Password

Update the password of a player using the Username Password IdProvider. Store the session token in a persistent storage in the app or on device. This endpoint is limited to 30 requests per minute per IP address instead of 15 per second. The shared 600 requests per hour limit still applies.
Authorizations
Client
HTTP: Client
HTTP Authorization Scheme: bearer

Header parameters for "Username Password Update Password"

ProjectId

string
required
example: 8bdacc33-6eef-4577-beb0-633c86259f5b
This is the Unity Project Id. It is a uuid format.

Authorization

string
example: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c
This is the bearer token for the user authorized to call this API.

Request body for "Username Password Update Password"

Media Type:
application/json

password

string
required
example: ThePassword123!
The password. Length must be between 8-30 and contain at least one uppercase letter, at least one lowercase letter, at least one number and at least one symbol.

newPassword

string
required
example: TheNewPassword456@
The password to be changed. Length must be between 8-30 and contain at least one uppercase letter, at least one lowercase letter, at least one number and at least one symbol.

HTTP response status codes for "Username Password Update Password":

Code samples for "Username Password Update Password":

Request example

curl -X POST \ -H "Authorization: Bearer <YOUR_TOKEN>" \ -H "Content-Type: application/json" \ -d '{ "password": "ThePassword123!", "newPassword": "TheNewPassword456@"}' \ "https://player-auth.services.api.unity.com/v1/authentication/usernamepassword/update-password"

Response example

{ "expiresIn": 3600, "idToken": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c", "sessionToken": "5eb26a338a232", "lastNotificationDate": "123000000", "user": { "disabled": false, "externalIds": [ { "externalId": "5eb26a338a232", "providerId": "provider-id" } ], "id": "eyJhbGciOiJIUzI1", "username": "New_User_57" }, "userId": "5eb26a338a232"}

Generate Code

Generates a sign in code for an unauthenticated device. This endpoint is limited to 30 requests per minute per IP address instead of 15 per second. The shared 600 requests per hour limit still applies.
Authorizations
Client
HTTP: Client
HTTP Authorization Scheme: bearer

Header parameters for "Generate Code"

ProjectId

string
required
example: 8bdacc33-6eef-4577-beb0-633c86259f5b
This is the Unity Project Id. It is a uuid format.

UnityEnvironment

string
example: production
This is the Environment you want to authorize a player to access. It is the name of the Environment. If this header is not specified, then the default Environment is used. An invalid environment name is not an acceptable input.

Request body for "Generate Code"

Media Type:
application/json

identifier

string
example: myDevice
Human-readable string to identify the requester device.

codeChallenge

string
required
SHA-256 string challenge for PKCE validation

HTTP response status codes for "Generate Code":

Code samples for "Generate Code":

Request example

curl -X POST \ -H "Authorization: Bearer <YOUR_TOKEN>" \ -H "Content-Type: application/json" \ -d '{ "identifier": "myDevice", "codeChallenge": "string"}' \ "https://player-auth.services.api.unity.com/v1/authentication/code-link/generate"

Response example

{ "codeLinkSessionId": "string", "signInCode": "f4j98K", "expiration": "string"}

Get Code Info

Get code information including the identifier and expiration. This endpoint is limited to 30 requests per minute per IP address instead of 15 per second. The shared 600 requests per hour limit still applies.
Authorizations
Client
HTTP: Client
HTTP Authorization Scheme: bearer

Header parameters for "Get Code Info"

ProjectId

string
required
example: 8bdacc33-6eef-4577-beb0-633c86259f5b
This is the Unity Project Id. It is a uuid format.

UnityEnvironment

string
example: production
This is the Environment you want to authorize a player to access. It is the name of the Environment. If this header is not specified, then the default Environment is used. An invalid environment name is not an acceptable input.

Request body for "Get Code Info"

Media Type:
application/json

signInCode

string
required
The code from which to get the info.

HTTP response status codes for "Get Code Info":

Code samples for "Get Code Info":

Request example

curl -X POST \ -H "ProjectId: <ProjectId>" \ -H "UnityEnvironment: <UnityEnvironment>" \ -H "Authorization: Bearer <YOUR_TOKEN>" \ -H "Content-Type: application/json" \ -d '{ "signInCode": "string"}' \ "https://player-auth.services.api.unity.com/v1/authentication/code-link/info"

Response example

{ "identifier": "myDevice", "expiration": "string"}

Sign In With Code

Tries to sign in a user with code. In the case this returns 200 and an empty response, poll at regular intervals, 2-5s to avoid being rate limited, until you receive a different response. This endpoint is limited to 30 requests per minute per IP address instead of 15 per second. The shared 600 requests per hour limit still applies.
Authorizations
Client
HTTP: Client
HTTP Authorization Scheme: bearer

Path parameters for "Sign In With Code"

CodeLinkSessionId

string
required
An identifier for the device requesting the code sign in.

Header parameters for "Sign In With Code"

ProjectId

string
required
example: 8bdacc33-6eef-4577-beb0-633c86259f5b
This is the Unity Project Id. It is a uuid format.

UnityEnvironment

string
example: production
This is the Environment you want to authorize a player to access. It is the name of the Environment. If this header is not specified, then the default Environment is used. An invalid environment name is not an acceptable input.

Request body for "Sign In With Code"

Media Type:
application/json

codeVerifier

string
required
Verifier for PKCE validation.

HTTP response status codes for "Sign In With Code":

Code samples for "Sign In With Code":

Request example

curl -X POST \ -H "Authorization: Bearer <YOUR_TOKEN>" \ -H "Content-Type: application/json" \ -d '{ "codeVerifier": "string"}' \ "https://player-auth.services.api.unity.com/v1/authentication/code-link/sign-in/{CodeLinkSessionId}"

Response example

{ "expiresIn": 3600, "idToken": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c", "sessionToken": "5eb26a338a232", "lastNotificationDate": "123000000", "user": { "disabled": false, "externalIds": [ { "externalId": "5eb26a338a232", "providerId": "provider-id" } ], "id": "eyJhbGciOiJIUzI1", "username": "New_User_57" }, "userId": "5eb26a338a232"}

Code Confirmation

Confirm a sign-in code, so the device that generated it signs in as this player. This endpoint is limited to 30 requests per minute per IP address instead of 15 per second. The shared 600 requests per hour limit still applies.
Authorizations
Client
HTTP: Client
HTTP Authorization Scheme: bearer

Header parameters for "Code Confirmation"

ProjectId

string
required
example: 8bdacc33-6eef-4577-beb0-633c86259f5b
This is the Unity Project Id. It is a uuid format.

UnityEnvironment

string
example: production
This is the Environment you want to authorize a player to access. It is the name of the Environment. If this header is not specified, then the default Environment is used. An invalid environment name is not an acceptable input.

Authorization

string
example: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c
This is the bearer token for the user authorized to call this API.

Request body for "Code Confirmation"

Media Type:
application/json

signInCode

string
required
example: f4j98K
The code returned in the GenerateCodeResponse.

sessionToken

string
The authenticated device session token, for added security.

idProvider

string
This is the id provider type. Only for consoles.

externalToken

string
External token to validate the user. Only for consoles.

HTTP response status codes for "Code Confirmation":

Code samples for "Code Confirmation":

Request example

curl -X POST \ -H "Authorization: Bearer <YOUR_TOKEN>" \ -H "Content-Type: application/json" \ -d '{ "signInCode": "f4j98K", "sessionToken": "string", "idProvider": "string", "externalToken": "string"}' \ "https://player-auth.services.api.unity.com/v1/authentication/code-link/confirm"

Response example

{ "title": "Bad Request", "status": 400, "detail": "Something is wrong", "details": [ { "code": "ERROR_CODE_123", "path": "nested.value", "message": "Invalid value" } ]}

Custom ID Sign In

Sign In using a Custom ID.
Set 
sessionTokenRestrictions
to mint a restricted session token directly, rather than narrowing an unrestricted one with a session-token refresh.
Authorizations
Admin (player_auth.server.custom_id_auth)
HTTP: Admin
HTTP Authorization Scheme: bearer
Required scopes: player_auth.server.custom_id_auth

Path parameters for "Custom ID Sign In"

ProjectId

string
required
This is the Unity Project Id. It is a uuid format.

Header parameters for "Custom ID Sign In"

UnityEnvironment

string
example: production
This is the Environment you want to authorize a player to access. It is the name of the Environment. If this header is not specified, then the default Environment is used. An invalid environment name is not an acceptable input.

Request body for "Custom ID Sign In"

Media Type:
application/json

externalId

string
required
example: externalId
The external id used to identify the player. Length must be between 1-320.

signInOnly

boolean
example: false
Whether the API should only attempt to sign-in and do not create a new player if the player does not exist.

accessToken

string
example: eyJhbGciOiJSUzI1NiIsImtpZCI6InB1YmxpYzo3MDdFQkJCNy05MEYzLTQ3NEYtOTA0NC02NDIzRUNDM0Q3NDkiLCJ0eXAiOiJKV1QifQ.eyJdWQiOlsiaWRkOmY1OWRmNDViLWY1YzUtNGE4Yy1iMmM0LWQzNDJiNmM5ZThkZiIsImVudk5hbWU6cHJvZHVjdGlvbiIsImVudklkOmRiNjQ5YzJiLWZjZTAtNDZkZS1iMGFhLTU1MzE1Y2VjYmUwNCIsInVwaWQ6NjU3YjViZGEtZWNmOS00NTFlLTk2NzMtODhlMjg4NTM2MzA1Il0sImV4cCI6MTcxMjg0NjA5NiwiaWF0IjoxNzEyODQyNDk2LCJpZGQiOiJmNTlkZjQ1Yi1mNWM1LTRhOGMtYjJjNC1kMzQyYjZjOWU4ZGYiLCJpc3MiOiJodHRwczovL3BsYXllci1hdXRoLXN0Zy5zZXJ2aWNlcy5hcGkudW5pdHkuY29tIiwianRpIjoiMjIyMjExNGUtMzE4Ni00ODljLTk3YzMtNjg4ZWI2NmJkNDVhIiwibmJmIjoxNzEyODQyNDk2LCJub25jZSI6Im51bGwiLCJwcm9qZWN0X2lkIjoiNjU3YjViZGEtZWNmOS00NTFlLTk2NzMtODhlMjg4NTM2MzA1Iiwic2lnbl9pbl9wcm92aWRlciI6ImFub255bW91cyIsInN1YiI6ImtzOWtJeW1iUnloMFVXVmVJbHBvVXZhR3ZueEoiLCJ0b2tlbl90eXBlIjoiYXV0aGVudGljYXRpb24iLCJ2ZXJzaW9uIjoiMSJ9.iVMwPYOp7qGNdzHS0CqWSdhGE7UTQOL_9J418zUJvlZtmDeslSSEinHAJn_Bv58yaVDNV1Z4dzSdKr5ixVDcxhVpe0lNkThFLRD6r2Ae36NNBKkSztBt9BD14k0_hwyU4beDrY7TUDHNfSppRczkBJAKp5T6eOt3rR9M7ilAOLJLd9Tz5l4aoJWkqG-V-S8qjkDvhiMdHE6HwGk2CVch5MGzTiBqHelCNoroA_cjkLFfUBkT4TTRUMBzXfrsyc8qat1iUPtAjxsvF91Y22d75PiPZAffSaCfT1vzIRWKZQcRH1QQl8BcSFUPGYAKrUKqlvP8njU1GuGYAluxJusseg
The access token of the existing player to link this Custom ID to.

sessionTokenRestrictions

object
Restrictions on the session token minted by this sign-in. Later refreshes treat them exactly as restrictions set on Session Token Sign In, including that an Origin policy can replace 
audiences
and 
ttlSeconds
unless 
narrowOnly
is set. Omit for an unrestricted session.

singleUse

boolean
example: true
Make the session token single-use, so its first refresh consumes it.

audiences

array[string]
example: ["cloud-save","leaderboards"]
Scope the session token to these services, as 
audiences
on Session Token Sign In.

ttlSeconds

integer
example: 60
Expire the session token after this many seconds. The returned ID token expires no later than this.

narrowOnly

boolean
example: true
Make these restrictions a ceiling for Origin policies, as 
narrowOnly
on Session Token Sign In. Set it when the token must not gain audiences such as 
player-auth
from an Origin policy, e.g. for a player identity your server has not verified. A short 
ttlSeconds
will not be extended, so usually leave it off.

HTTP response status codes for "Custom ID Sign In":

Code samples for "Custom ID Sign In":

Request example

curl -X POST \ -H "Authorization: Bearer <YOUR_TOKEN>" \ -H "Content-Type: application/json" \ -d '{ "externalId": "externalId", "signInOnly": false, "accessToken": "eyJhbGciOiJSUzI1NiIsImtpZCI6InB1YmxpYzo3MDdFQkJCNy05MEYzLTQ3NEYtOTA0NC02NDIzRUNDM0Q3NDkiLCJ0eXAiOiJKV1QifQ.eyJdWQiOlsiaWRkOmY1OWRmNDViLWY1YzUtNGE4Yy1iMmM0LWQzNDJiNmM5ZThkZiIsImVudk5hbWU6cHJvZHVjdGlvbiIsImVudklkOmRiNjQ5YzJiLWZjZTAtNDZkZS1iMGFhLTU1MzE1Y2VjYmUwNCIsInVwaWQ6NjU3YjViZGEtZWNmOS00NTFlLTk2NzMtODhlMjg4NTM2MzA1Il0sImV4cCI6MTcxMjg0NjA5NiwiaWF0IjoxNzEyODQyNDk2LCJpZGQiOiJmNTlkZjQ1Yi1mNWM1LTRhOGMtYjJjNC1kMzQyYjZjOWU4ZGYiLCJpc3MiOiJodHRwczovL3BsYXllci1hdXRoLXN0Zy5zZXJ2aWNlcy5hcGkudW5pdHkuY29tIiwianRpIjoiMjIyMjExNGUtMzE4Ni00ODljLTk3YzMtNjg4ZWI2NmJkNDVhIiwibmJmIjoxNzEyODQyNDk2LCJub25jZSI6Im51bGwiLCJwcm9qZWN0X2lkIjoiNjU3YjViZGEtZWNmOS00NTFlLTk2NzMtODhlMjg4NTM2MzA1Iiwic2lnbl9pbl9wcm92aWRlciI6ImFub255bW91cyIsInN1YiI6ImtzOWtJeW1iUnloMFVXVmVJbHBvVXZhR3ZueEoiLCJ0b2tlbl90eXBlIjoiYXV0aGVudGljYXRpb24iLCJ2ZXJzaW9uIjoiMSJ9.iVMwPYOp7qGNdzHS0CqWSdhGE7UTQOL_9J418zUJvlZtmDeslSSEinHAJn_Bv58yaVDNV1Z4dzSdKr5ixVDcxhVpe0lNkThFLRD6r2Ae36NNBKkSztBt9BD14k0_hwyU4beDrY7TUDHNfSppRczkBJAKp5T6eOt3rR9M7ilAOLJLd9Tz5l4aoJWkqG-V-S8qjkDvhiMdHE6HwGk2CVch5MGzTiBqHelCNoroA_cjkLFfUBkT4TTRUMBzXfrsyc8qat1iUPtAjxsvF91Y22d75PiPZAffSaCfT1vzIRWKZQcRH1QQl8BcSFUPGYAKrUKqlvP8njU1GuGYAluxJusseg", "sessionTokenRestrictions": { "singleUse": true, "audiences": [ "cloud-save", "leaderboards" ], "ttlSeconds": 60, "narrowOnly": true }}' \ "https://player-auth.services.api.unity.com/v1/projects/{ProjectId}/authentication/server/custom-id"

Response example

{ "expiresIn": 3600, "idToken": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c", "sessionToken": "5eb26a338a232", "lastNotificationDate": "123000000", "user": { "disabled": false, "externalIds": [ { "externalId": "5eb26a338a232", "providerId": "provider-id" } ], "id": "eyJhbGciOiJIUzI1", "username": "New_User_57" }, "userId": "5eb26a338a232"}

Read Notification

Gets a player's notifications to be displayed by the client.
Authorizations
Client
HTTP: Client
HTTP Authorization Scheme: bearer

Path parameters for "Read Notification"

PlayerId

string
required
example: 99i9ju8juh
This is the player id.

Header parameters for "Read Notification"

Authorization

string
example: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c
This is the bearer token for the user authorized to call this API.

ProjectId

string
required
example: 8bdacc33-6eef-4577-beb0-633c86259f5b
This is the Unity Project Id. It is a uuid format.

HTTP response status codes for "Read Notification":

Code samples for "Read Notification":

Request example

curl -X GET \ -H "Authorization: Bearer <YOUR_TOKEN>" \ "https://player-auth.services.api.unity.com/v1/users/{PlayerId}/notifications"

Response example

{ "notifications": [ { "id": "string", "type": "DSA", "playerID": "string", "caseID": "string", "projectID": "string", "message": "string", "createdAt": "string", "updatedAt": "string", "deletedAt": "string" } ]}