Authentication #
With Pragma Engine you can use your own identity provider to authenticate your players and operators. Authenticated players and operators can then use your game client to make requests to Pragma Engine.
After a player logs in to your identity provider, the identity provider passes a session token to the Pragma Engine. The engine then exchanges the provider token for a Pragma session token. For more information about sessions, see Login and Session.
To try out setting up authentication, see the Unreal and Unity authentication tutorials.
Player and Operator authentication #
Pragma Engine supports multiple identity providers for Player and Operator authentication. Below are the available identity providers and their respective values. For more information, see Identity Providers.
Identity Provider | Identity Provider Values |
---|---|
UNSAFE | 1 |
EPIC | 2 |
DISCORD | 3 |
STEAM | 4 |
5 | |
6 | |
PLAYSTATION | 7 |
TWITCH | 8 |
XBOX | 9 |
OKTA | 10 |
AUTH0 | 11 |
GOOGLEWORKSPACE | 12 |
To add additional identity providers, see Custom Identity Providers.
You can use either the identity provider name or identity provider value on authenticateorcreatev2
for the providerId
.
The following examples show the required authenticateorcreatev2
request body. authenticateorcreatev2
is designed for game logins using the Pragma SDK. If you don’t use the Pragma SDK to authenticate your users, see Authenticate using RPC.
Authenticate with RPC #
When authenticating with Pragma, we recommend you use the Pragma SDK. The Pragma SDK completes all the following steps for you and reduces the possibility for errors. For more information about authentication using the Pragma SDK, see Pragma Engine SDK Setup Guides.
To manually create an authentication workflow for your client, use the following steps.
- Make a call to the
getinqueue
endpoint. The endpoint returns a JSON object with an encryptedloginQueuePassToken
.- Check the
isAllowed
field in the JSON object. - If the
isAllowed
field isfalse
continue to poll using thecheckTicket
endpoint until the JSON object returns withisAllowed
set totrue
.
- Check the
- When the
isAllowed
field is set totrue
, make a call to theauthenticateorcreatev2
endpoint with theloginQueuePassToken
included in theauthenticateorcreatev2
request body.
If you enable the devLoginQueueBypass
configuration, skip the above steps. The authenticateorcreatev2
body won’t have the
loginQueuePassToken
. For more information, see Login queue testing and development.
Web portal sign in and sign up #
Pragma Engine offers two endpoints for players signing in and signing up on a web portal:
/v1/accounts/authenticatev1
/v1/accounts/createaccountv1
This authentication flow is optimized for web portal sign in and sign up, and only provides social tokens. Since players will be prompted in the web portal when creating an account, this flow prevents accidental account creation.
We recommend using these endpoints only for web portals since they are not subject to login queue. Login queue is integral for managing server load in multiplayer games. These endpoints are for social login only.
Web portal authentication #
To authenticate a player’s Pragma Engine account call /v1/accounts/authenticatev1
. There are two possible scenarios dependent on if a Pragma Engine account exists for the given identity provider account:
- If the account exists, it is authenticated and a social token is returned.
- If the account does not exist, the public endpoint returns HTTP 403 Forbidden and the platform returns an
AccountService_NotFound
error message.
Web portal account creation #
To create a Pragma Engine account for a player call /v1/accounts/createaccountv1
. There are two possible scenarios dependent on if a Pragma Engine account exists for the given identity provider account:
- If there is an existing account, the public endpoint returns HTTP 409 Conflict and the platform returns an
AccountService_AlreadyExists
error message. - If there is no existing account, a new Pragma Engine account is created. The newly created account is authenticated and a social token is returned.
Generate Partner tokens #
Once you have successfully authenticated into Pragma Engine as an Operator, you can generate trusted Partner tokens.
Use Operator Portal #
Partner tokens can be generated for both production and test environments using Operator Portal.
- Access the Social Operator Portal by opening the
11200
port for your game and log in. Use thePragma Unsafe
login for test environments, and one of the verified identity provider logins for production environments. - Open the Services section, and select the Game Server Management page.
- Use the Select a Game Shard dropdown to select the game shard to associate it with the generated Partner token.
- On the Partner Tokens tab, click + Create Tokens to generate Partner tokens for both Game and Social.
Use Postman #
Partner tokens can only be generated for test environments using Postman, because the authentication step uses the Unsafe Provider.
- Send
authenticateorcreatev2
as an Operator. - Send
createpartnertokenV1
with the correctgameShardId
to receive a payload with Partner tokens for both Game and Social.
Game tokens are valid per game shard, and social tokens are valid across the entire Social gateway.
To generate unique partner tokens per game server, see the Fleet service task.