Setting Up Identity Providers #

This guide walks you through setting up identity providers and Pragma’s test provider.

Configure your identity provider #

Prerequisites:
Before integrating with Pragma Engine, you’ll need to have set up an account with a third party provider.

Add the relevant configuration code blocks to local-dev.yml (for local testing) or one of the specific environments under your config/shard folder. For example production.yml for a production environment.

Steam #

Steam configuration

To create a Steam application and obtain an App ID, navigate to the Steamworks Application page.

To create a Publisher Web API Key, navigate to the Steamworks Authentication page.

social:
  pluginConfigs:
    AccountService.identityProviderPlugins:
      plugins:
        Steam:
          class: "pragma.account.SteamIdentityProviderPlugin"
          config:
            appId: "${steamAppId}"
            steamWebAPIKey: "${steamWebApiKey}"
            restrictByAppOwnership: false
            restrictByAccountBan: false
            playerLoginEnabled: true
            operatorLoginEnabled: false
            accountLinkingEnabled: true
            accountUnlinkingEnabled: false
            accountLinkingCooldownInDays: 0
            accountLinkingOneAssociationOnly: false
            showPortalLoginButton: false
            visibleToOtherPlayers: true

value	description
`appId`	Steam numerical value used to identify a game on Steam.
`steamWebAPIKey`	Authorization key used to connect with the Steam Web API.
`restrictByAppOwnership`	optional Boolean determining whether to reject users if they don’t own the app or are on a timed trial.
`restrictByAccountBan`	optional Boolean determining whether to reject users who have been developer banned or VAC banned.
`playerLoginEnabled`	optional Boolean determining whether to establish a player session with this identity provider.
`operatorLoginEnabled`	optional Boolean determining whether to establish an operator session with this identity provider.
`accountLinkingEnabled`	optional Boolean determining whether you can link accounts with this identity provider.
`showPortalLoginButton`	optional Boolean determining whether this login method is available on the portal login page.
`visibleToOtherPlayers`	optional Boolean determining whether Steam account information is visible to other players.
`accountLinkingCooldownInDays`	optional The number of days a player must wait before linking a new account. This is scoped by provider and begins once the player unlinks their account.
`accountLinkingOneAssociationOnly`	optional Boolean determining whether a player can have more than one unique account from the same identity provider. If set to `false`, the player can unlink their current account and link a different one.
`accountUnlinkingEnabled`	optional Boolean determining whether a player can unlink their account in the Player Portal.
`gameShardIds`	optional A list of game shard IDs that use this ID Provider to authenticate.

Epic #

Epic configuration

To create an Epic client and obtain a Client ID and Client Secret, navigate to the Epic Client Credentials page.

To find the Deployment ID or Sandbox ID, navigate to the Product Settings page in the Epic Developer Portal.

To find the Audience Item ID, navigate to the Epic Games Store Offers page in the Epic Developer Portal and select the offer.

social:
  pluginConfigs:
    AccountService.identityProviderPlugins:
      plugins:
        Epic:
          class: "pragma.account.EpicIdentityProviderPlugin"
          config:
            clientId: "epic-client-id"
            clientSecret: "encrypted-epic-client-secret"
            redirectUri: "http://localhost:11200/v1/account/oauth-redirect/EPIC"
            restrictByCatalogItemOwnership: true
            deploymentId: "epic-deployment-id"
            sandboxId: "epic-sandbox-id"
            catalogItemId: "epic-catalog-item-id"
            playerLoginEnabled: true
            operatorLoginEnabled: false
            accountLinkingEnabled: true
            accountUnlinkingEnabled: false
            accountLinkingCooldownInDays: 0
            accountLinkingOneAssociationOnly: false
            showPortalLoginButton: false
            visibleToOtherPlayers: true

value	description
`clientId`	Epic ID that identifies developer’s Epic app while making authorization requests.
`clientSecret`	Encrypted OAuth secret for the Epic app referenced by the `clientId` property.
`redirectUri`	optional Backend authorization endpoint that Epic uses to validate OAuth handshakes.
`restrictByCatalogItemOwnership`	optional Boolean determining whether to reject users if they do not own the catalog item specified. If set to `true`, the following configs must be configured: `sandboxId` and `catalogItemId`.
`sandboxId`	ID of the sandbox environment you’d like to validate against.
`catalogItemId`	ID of the catalog item you’d like to validate against. Typically this will be the Game Item ID of your game.
`deploymentId`	optional This field is only required if OAuth login is enabled (portal login). ID of the deployment you’d like to validate against. For more information, refer to Epic’s documentation on Requesting an Access Token.
`playerLoginEnabled`	Boolean determining whether to establish a player session with this identity provider.
`operatorLoginEnabled`	optional Boolean determining whether to establish an operator session with this identity provider.
`accountLinkingEnabled`	optional Boolean determining whether you can link accounts with this identity provider.
`showPortalLoginButton`	optional Boolean determining whether this login method is available on the portal login page.
`visibleToOtherPlayers`	optional Boolean determining whether Epic account information is visible to other players.
`accountLinkingCooldownInDays`	optional The number of days a player must wait before linking a new account. This is scoped by provider and begins once the player unlinks their account.
`accountLinkingOneAssociationOnly`	optional Boolean determining whether a player can have more than one unique account from the same identity provider. If set to `false`, the player can unlink their current account and link a different one.
`accountUnlinkingEnabled`	optional Boolean determining whether a player can unlink their account in the Player Portal.
`gameShardIds`	optional A list of game shard IDs that use this ID Provider to authenticate.

Discord #

Discord configuration

To create a Discord application and obtain a Client ID and Client Secret, navigate to the Discord OAuth2 page.

To find role IDs for Allowed Role IDs, navigate to the Roles page in your Discord server settings.

social:
  pluginConfigs:
    AccountService.identityProviderPlugins:
      plugins:
        Discord:
          class: "pragma.account.DiscordIdentityProviderPlugin"
          config:
            clientId: "${discordClientId}"
            clientSecret: "${discordClientSecret}"
            redirectUri: "http://localhost:11000/v1/account/discord-redirect"
            botToken: "${discordBotToken}"
            guildId: "${guildId}"
            allowedRoleIds: 
              1: "${RoleId1}"
              2: "${RoleId2}"
            playerLoginEnabled: true
            operatorLoginEnabled: false
            accountLinkingEnabled: true
            accountUnlinkingEnabled: false
            accountLinkingCooldownInDays: 0
            accountLinkingOneAssociationOnly: false
            showPortalLoginButton: false
            visibleToOtherPlayers: false

value	description
`clientId`	Discord OAuth ID that identifies developer’s Discord app while making authorization requests.
`clientSecret`	Encrypted OAuth secret for the Discord app referenced by the `clientId` property.
`redirectUri`	optional Backend authorization endpoint that Discord uses to validate OAuth handshakes.
`botToken`	optional Unique ID for Discord server bots.
`guildId`	optional Discord-defined guild identifier.
`allowedRoleIds`	optional Map of user roles that are allowed to authenticate. Discord rate limits requests using these values to 5 per second. See Discord’s Rate limits documentation for details.
`playerLoginEnabled`	optional Boolean determining whether to establish a player session with this identity provider.
`operatorLoginEnabled`	optional Boolean determining whether to establish an operator session with this identity provider.
`accountLinkingEnabled`	optional Boolean determining whether you can link accounts with this identity provider.
`showPortalLoginButton`	optional Boolean determining whether this login method is available on the portal login page.
`visibleToOtherPlayers`	optional Boolean determining whether Discord account information is visible to other players.
`accountLinkingCooldownInDays`	optional The number of days a player must wait before linking a new account. This is scoped by provider and begins once the player unlinks their account.
`accountLinkingOneAssociationOnly`	optional Boolean determining whether a player can have more than one unique account from the same identity provider. If set to `false`, the player can unlink their current account and link a different one.
`accountUnlinkingEnabled`	optional Boolean determining whether a player can unlink their account in the Player Portal.
`gameShardIds`	optional A list of game shard IDs that use this ID Provider to authenticate.

Check out the Unreal and Unity Setup Guides for Discord implementation details.

Google #

Google configuration

To create a Google application and obtain a Client ID and Client Secret, navigate to the Google API Console page.

social:
  pluginConfigs:
    AccountService.identityProviderPlugins:
      plugins:
        Google:
          class: "pragma.account.GoogleIdentityProviderPlugin"
          config:
            allowedDomains:
              1: "${allowedDomain1}"
              2: "${allowedDomain2}"
            clientId: "${googleClientId}"
            clientSecret: "${googleClientSecret}"
            redirectUri: "http://localhost:11000/v1/account/google-redirect"
            playerLoginEnabled: true
            operatorLoginEnabled: false
            accountLinkingEnabled: true
            accountUnlinkingEnabled: false
            accountLinkingCooldownInDays: 0
            accountLinkingOneAssociationOnly: false
            showPortalLoginButton: false
            visibleToOtherPlayers: false

value	description
`clientId`	Google OAuth ID that identifies developer’s Google app while making authorization requests.
`clientSecret`	Encrypted OAuth secret for the Google app referenced by the `clientId` property.
`redirectUri`	optional Backend authorization endpoint that Google uses to validate OAuth handshakes.
`allowedDomains`	optional Map of specific domains that are authorized for access–if this value is defined, all other domains are rejected.
`playerLoginEnabled`	optional Boolean determining whether to establish a player session with this identity provider.
`operatorLoginEnabled`	optional Boolean determining whether to establish an operator session with this identity provider.
`accountLinkingEnabled`	optional Boolean determining whether you can link accounts with this identity provider.
`showPortalLoginButton`	optional Boolean determining whether this login method is available on the portal login page.
`visibleToOtherPlayers`	optional Boolean determining whether Google account information is visible to other players
`accountLinkingCooldownInDays`	optional The number of days a player must wait before linking a new account. This is scoped by provider and begins once the player unlinks their account.
`accountLinkingOneAssociationOnly`	optional Boolean determining whether a player can have more than one unique account from the same identity provider. If set to `false`, the player can unlink their current account and link a different one.
`accountUnlinkingEnabled`	optional Boolean determining whether a player can unlink their account in the Player Portal.
`gameShardIds`	optional A list of game shard IDs that use this ID Provider to authenticate.

Check out the Google developer documentation for creating access credentials.

Google Workspace #

Google Workspace configuration

Google Workspace has been added as an identity provider to support the difference between a public Google authentication and an internal one.

To create a Google Workspace application and obtain a Client ID and Client Secret, navigate to the Google Credentials page.

social:
  pluginConfigs:
    AccountService.identityProviderPlugins:
      plugins:
        GoogleWorkspace:
          class: "pragma.account.GoogleWorkspaceIdentityProviderPlugin"
          config:
            allowedDomains:
              1: "${allowedDomain1}"
              2: "${allowedDomain2}"
            clientId: "${googleClientId}"
            clientSecret: "${googleClientSecret}"
            redirectUri: "http://localhost:11000/v1/account/google-redirect"
            playerLoginEnabled: false
            operatorLoginEnabled: true
            accountLinkingEnabled: false
            accountUnlinkingEnabled: false
            accountLinkingCooldownInDays: 0
            accountLinkingOneAssociationOnly: false
            showPortalLoginButton: true
            visibleToOtherPlayers: false

value	description
`clientId`	Google Workspace OAuth ID that identifies developer’s Google Workspace app while making authorization requests.
`clientSecret`	Encrypted OAuth secret for the Google Workspace app referenced by the `clientId` property.
`redirectUri`	optional Backend authorization endpoint that Google Workspace uses to validate OAuth handshakes.
`allowedDomains`	optional Map of specific domains that are authorized for access–if this value is defined, all other domains are rejected.
`playerLoginEnabled`	optional Boolean determining whether to establish a player session with this identity provider.
`operatorLoginEnabled`	optional Boolean determining whether to establish an operator session with this identity provider.
`accountLinkingEnabled`	optional Boolean determining whether you can link accounts with this identity provider.
`showPortalLoginButton`	optional Boolean determining whether this login method is available on the portal login page.
`visibleToOtherPlayers`	optional Boolean determining whether Google Workspace account information is visible to other players.
`accountLinkingCooldownInDays`	optional The number of days a player must wait before linking a new account. This is scoped by provider and begins once the player unlinks their account.
`accountLinkingOneAssociationOnly`	optional Boolean determining whether a player can have more than one unique account from the same identity provider. If set to `false`, the player can unlink their current account and link a different one.
`accountUnlinkingEnabled`	optional Boolean determining whether a player can unlink their account in the Player Portal.
`gameShardIds`	optional A list of game shard IDs that use this ID Provider to authenticate.

Check out the Google developer documentation for creating access credentials.

Twitch #

Twitch configuration

To create a Twitch application and obtain a Client ID and Client Secret, navigate to the Twitch Authentication page.

social:
  pluginConfigs:
    AccountService.identityProviderPlugins:
      plugins:
        Twitch:
          class: "pragma.account.TwitchIdentityProviderPlugin"
          config:
            clientId: "${twitchClientId}"
            clientSecret: "${twitchClientSecret}"
            redirectUri: "http://localhost:11000/v1/account/twitch-redirect"
            playerLoginEnabled: false
            operatorLoginEnabled: false
            accountLinkingEnabled: true
            accountUnlinkingEnabled: false
            accountLinkingCooldownInDays: 0
            accountLinkingOneAssociationOnly: false
            showPortalLoginButton: false
            visibleToOtherPlayers: false

value	description
`clientId`	Twitch OAuth ID that identifies developer’s Twitch app while making authorization requests.
`clientSecret`	Encrypted OAuth secret for the Twitch app referenced by the `clientId` property.
`redirectUri`	optional Backend authorization endpoint that Twitch uses to validate OAuth handshakes.
`playerLoginEnabled`	optional Boolean determining whether to establish a player session with this identity provider.
`operatorLoginEnabled`	optional Boolean determining whether to establish an operator session with this identity provider.
`accountLinkingEnabled`	optional Boolean determining whether you can link accounts with this identity provider.
`showPortalLoginButton`	optional Boolean determining whether this login method is available on the portal login page.
`visibleToOtherPlayers`	optional Boolean determining whether Twitch account information is visible to other players.
`accountLinkingCooldownInDays`	optional The number of days a player must wait before linking a new account. This is scoped by provider and begins once the player unlinks their account.
`accountLinkingOneAssociationOnly`	optional Boolean determining whether a player can have more than one unique account from the same identity provider. If set to `false`, the player can unlink their current account and link a different one.
`accountUnlinkingEnabled`	optional Boolean determining whether a player can unlink their account in the Player Portal.
`gameShardIds`	optional A list of game shard IDs that use this ID Provider to authenticate.

Meta Quest #

Meta Quest

To create a Meta organization and obtain an Organization ID, navigate to the Meta Distribution page.

To find the App ID and App Credentials, navigate to the Meta Account Linking page.

MetaQuest:
  class: "pragma.account.MetaQuestIdentityProviderPlugin"
  config:
    appId: "APP_ID"
    appCredentials: "OC|APP_ID|SECRET"
    orgId: "ORG_ID"
    showPortalLoginButton: true
    accountLinkingEnabled: true
    accountUnlinkingEnabled: false
    playerLoginEnabled: true
    operatorLoginEnabled: true
    accountLinkingCooldownInDays: 0
    accountLinkingOneAssociationOnly: false

value	description
`appId`	ID that identifies developer’s Meta Quest app while making authorization requests.
`appCredentials`	Secret credentials displayed in Meta Quest app.
`orgId`	ID of your Meta Quest organization.
`redirectUri`	optional Backend authorization endpoint that auth0 uses to validate OAuth handshakes.
`requireEmailVerification`	Boolean determining whether email is required.
`playerLoginEnabled`	optional Boolean determining whether to establish a player session with this identity provider.
`operatorLoginEnabled`	optional Boolean determining whether to establish an operator session with this identity provider.
`accountLinkingEnabled`	optional Boolean determining whether you can link accounts with this identity provider.
`showPortalLoginButton`	optional Boolean determining whether this login method is available on the portal login page.
`visibleToOtherPlayers`	optional Boolean determining whether Auth0 account information is visible to other players.
`accountLinkingCooldownInDays`	optional The number of days a player must wait before linking a new account. This is scoped by provider and begins once the player unlinks their account.
`accountLinkingOneAssociationOnly`	optional Boolean determining whether a player can have more than one unique account from the same identity provider. If set to `false`, the player can unlink their current account and link a different one.
`accountUnlinkingEnabled`	optional Boolean determining whether a player can unlink their account in the Player Portal.
`gameShardIds`	optional A list of game shard IDs that use this ID Provider to authenticate.

Okta #

Okta configuration

To create an Okta application and obtain a Client ID and Client Secret, navigate to the Okta Credentials page.

To find the User Info URI, Authorization URI, and Token URI navigate to the Okta Developer Documentation pages.

social:
  pluginConfigs:
    AccountService.identityProviderPlugins:
      plugins:
        Okta:
          class: "pragma.account.OktaIdentityProviderPlugin"
          config:
            clientId: "${OktaClientId}"
            clientSecret: "${OktaClientSecret}"
            authorizationUri: "https://your-okta-subdomain.okta.com/oauth2/v1/authorize"
            tokenUri: "https://your-okta-subdomain.okta.com/oauth2/v1/token"
            userInfoUri: "https://your-okta-subdomain.okta.com/oauth2/v1/userinfo"
            redirectUri: "http://localhost:11000/v1/account/Okta-redirect"
            requireEmailVerification: true
            playerLoginEnabled: false
            operatorLoginEnabled: true
            accountLinkingEnabled: false
            accountUnlinkingEnabled: false
            accountLinkingCooldownInDays: 0
            accountLinkingOneAssociationOnly: false
            showPortalLoginButton: true
            visibleToOtherPlayers: false

value	description
`clientId`	Okta OAuth ID that identifies developer’s Okta app while making authorization requests.
`clientSecret`	Encrypted OAuth secret for the Okta app referenced by the `clientId` property.
`authorizationUri`	URI the user will be sent to for authenticatication with Okta.
`tokenUri`	URI to obtain an access token by sending an auth code.
`userInfoUri`	URI to obtain information about the user.
`redirectUri`	optional Backend authorization endpoint that Okta uses to validate OAuth handshakes.
`requireEmailVerification`	Boolean determining whether email is required.
`playerLoginEnabled`	optional Boolean determining whether to establish a player session with this identity provider.
`operatorLoginEnabled`	optional Boolean determining whether to establish an operator session with this identity provider.
`accountLinkingEnabled`	optional Boolean determining whether you can link accounts with this identity provider.
`showPortalLoginButton`	optional Boolean determining whether this login method is available on the portal login page.
`visibleToOtherPlayers`	optional Boolean determining whether Okta account information is visible to other players.
`accountLinkingCooldownInDays`	optional The number of days a player must wait before linking a new account. This is scoped by provider and begins once the player unlinks their account.
`accountLinkingOneAssociationOnly`	optional Boolean determining whether a player can have more than one unique account from the same identity provider. If set to `false`, the player can unlink their current account and link a different one.
`accountUnlinkingEnabled`	optional Boolean determining whether a player can unlink their account in the Player Portal.
`gameShardIds`	optional A list of game shard IDs that use this ID Provider to authenticate.

Auth0 #

Auth0 configuration

To create an Auth0 application and obtain a Client ID and Client Secret, navigate to the Auth0 Application Settings page.

To find the User Info URI, Authorization URI, and Token URI navigate to the Endpoints tab in your application’s Advanced Settings in the Auth0 portal.

social:
  pluginConfigs:
    AccountService.identityProviderPlugins:
      plugins:
        Twitch:
          class: "pragma.account.Auth0IdentityProviderPlugin"
          config:
            clientId: "auth0-client-id"
            clientSecret: "auth0-client-secret"
            authorizationUri: "https://your-auth0-subdomain.us.auth0.com/authorize"
            tokenUri: "https://your-auth0-subdomain.us.auth0.com/oauth/token"
            userInfoUri: "https://your-auth0-subdomain.us.auth0.com/userinfo"
            redirectUri: "https://localhost:11200/v1/oauth-redirect/auth0"
            requireEmailVerification: true
            playerLoginEnabled: false
            operatorLoginEnabled: true
            accountLinkingEnabled: false
            accountUnlinkingEnabled: false
            accountLinkingCooldownInDays: 0
            accountLinkingOneAssociationOnly: false
            showPortalLoginButton: true
            visibleToOtherPlayers: false

value	description
`clientId`	Auth0 OAuth ID that identifies developer’s auth0 app while making authorization requests.
`clientSecret`	Encrypted OAuth secret for the auth0 app referenced by the `clientId` property.
`authorizationUri`	URI the user will be sent to for authenticatication with Auth0.
`tokenUri`	URI to obtain an access token by sending an auth code.
`userInfoUri`	URI to obtain information about the user.
`redirectUri`	optional Backend authorization endpoint that auth0 uses to validate OAuth handshakes.
`requireEmailVerification`	Boolean determining whether email is required.
`playerLoginEnabled`	optional Boolean determining whether to establish a player session with this identity provider.
`operatorLoginEnabled`	optional Boolean determining whether to establish an operator session with this identity provider.
`accountLinkingEnabled`	optional Boolean determining whether you can link accounts with this identity provider.
`showPortalLoginButton`	optional Boolean determining whether this login method is available on the portal login page.
`visibleToOtherPlayers`	optional Boolean determining whether Auth0 account information is visible to other players.
`accountLinkingCooldownInDays`	optional The number of days a player must wait before linking a new account. This is scoped by provider and begins once the player unlinks their account.
`accountLinkingOneAssociationOnly`	optional Boolean determining whether a player can have more than one unique account from the same identity provider. If set to `false`, the player can unlink their current account and link a different one.
`accountUnlinkingEnabled`	optional Boolean determining whether a player can unlink their account in the Player Portal.
`gameShardIds`	optional A list of game shard IDs that use this ID Provider to authenticate.

PlayStation #

PlayStation configuration

Pragma Engine supports PlayStation Network integration. Contact us for details.

Xbox #

Xbox configuration

Pragma Engine supports Xbox integration. Contact us for details.

For identity providers not listed, studios can implement a custom Identity Provider Plugin. See the Create Custom Identity Providers page for more information.

Inform third party platforms of Pragma OAuth redirect URIs #

Any identity provider that uses OAuth requires a list of authorized redirect URIs to allow the Pragma Engine platform to authenticate with it.

These are redirect URIs you’ll need to configure on the third party platform.

Example: Local development

For local development you’ll need to set these redirect URIs. For example if you were setting up Discord it would be:

http://localhost:11000/v1/account/discord-redirect
http://localhost:11000/redirect/SignInDiscord

To enable authentication for the SDK or external clients:

http://localhost:11000/v1/account/{provider}-redirect

To enable Operator Portal authentication:

http://localhost:11200/redirect/SignIn{Provider}
http://localhost:10200/redirect/SignIn{Provider}

To enable Player Portal authentication and account linking:

http://localhost:11000/redirect/SignIn{Provider}
http://localhost:11000/redirect/Link{Provider}

Example: Deployed shard environment

For a deployed shard environment for Pragma hosting you’ll need to set these redirect URIs:

To enable users to login directly through the game client:

https://{shard}.{game_name}.{studio}.pragmaengine.com:11000/v1/account/{provider}-redirect

To enable Operator Portal authentication:

https://{shard}.internal.{game_name}.{studio}.pragmaengine.com:11200/redirect/SignIn{Provider}
https://{shard}.internal.{game_name}.{studio}.pragmaengine.com:10200/redirect/SignIn{Provider}

To enable Player Portal authentication and account linking add:

https://{shard}.{game_name}.{studio}.pragmaengine.com:11000/redirect/SignIn{Provider}
https://{shard}.{game_name}.{studio}.pragmaengine.com:11000/redirect/Link{Provider}

The examples for the Player Portal authentication and account linking use the Pragma default port of 11000. If you are using the standard port 443 instead you can omit the port numbers in these URIs.

Get started with Unsafe Identity Provider #

To enable the Unsafe Identity Provider, add the following:

local-dev.yml

 social:
  serviceConfigs:
    UnsafeIdentityDaoConfig:
      databaseConfig:
        username: "superuser"
        password: "password"
        hostPortSchema: "localhost:3306/local_social_unsafe_identity_provider"
  pluginConfigs:
    AccountService.identityProviderPlugins:
      plugins:
        Unsafe:
          class: "pragma.account.UnsafeIdentityProviderPlugin"

In a managed environment, reach out to your customer representative to find the proper credentials for your database.

[optional] Set account linking restrictions #

You can specify the period of a time a user must wait before linking a new account for a given provider using accountLinkingCooldownInDays. In addition, you can use accountLinkingOneAssociationOnly to determine whether or not to restrict provider types from having only one account tied to it.

[optional] Set up multi-game authentication #

You can specify a set of game shard IDs that will use a given ID provider plugin to authenticate. This allows you to specify different IDs, secrets, and configurations on a per game basis.

Player portal logins will use the ID provider block that doesn’t specify a game shard ID because it is a social-only login. The same default block will also be used for game login if no id provider is configured with that specific game shard ID.

For example, to authenticate two different Steam App IDs:

AccountService.identityProviderPlugins:
  plugins:
    SteamPlayerPortal:
      class: "pragma.account.SteamIdentityProviderPlugin"
      config:
        steamWebAPIKey: "..."
    SteamGameA:
      class: "pragma.account.SteamIdentityProviderPlugin"
      config:
        gameShardIds:
          1: "00000000-0000-0000-0000-000000000001"
        restrictByAppOwnership: true
        appId: "123"
        steamWebAPIKey: "..."
    SteamGameB:
      class: "pragma.account.SteamIdentityProviderPlugin"
      config:
        gameShardIds:
          1: "00000000-0000-0000-0000-000000000002"
        restrictByAppOwnership: true
        appId: "456"
        steamWebAPIKey: "..."