Authentication

Nakama requires every client to authenticate before accessing server features. Client applications connect using a server key that identifies and authorizes the application. Individual users then authenticate using one of the supported methods to obtain a session token.

The default server key is defaultkey. Change this to a unique value before deploying to production and embed it in your client code.

1
2

var useSSL = false;
var client = new nakamajs.Client("defaultkey", "127.0.0.1", 7350, useSSL);

1
2

// Use "https" scheme if you've setup SSL.
var client = new Client("http", "127.0.0.1", 7350, "defaultkey");

1
2
3
4
5

NClientParameters parameters;
parameters.serverKey = "defaultkey";
parameters.host = "127.0.0.1";
parameters.port = DEFAULT_PORT;
NClientPtr client = createDefaultClient(parameters);

1
2
3

Client client = new DefaultClient("defaultkey", "127.0.0.1", 7349, false)
// or same as above.
Client client = DefaultClient.defaults("defaultkey");

1

onready var client := Nakama.create_client("defaultkey", "127.0.0.1", 7350, "http")

1

@onready var client := Nakama.create_client("defaultkey", "127.0.0.1", 7350, "http")

 1
 2
 3
 4
 5
 6
 7
 8
 9
10

local defold = require "nakama.engine.defold"

local config = {}
config.host = 127.0.0.1
config.port = 7350
config.use_ssl = false
config.username = "defaultkey"
config.engine = defold

local client = nakama.create_client(config)

1

let client = GrpcClient(serverKey: "defaultkey", trace: true)

1
2
3
4
5

final client = getNakamaClient(
  host: '127.0.0.1',
  ssl: false,
  serverKey: 'defaultkey',
);

Each user account can have multiple authentication methods linked to it, allowing the same user to sign in across different devices or platforms.

How accounts and identifiers relate #

A Nakama account is one server-side record with one or more identifiers linked to it. An account can have multiple device IDs, but only one social ID per provider: one Apple ID, one Game Center player, one Google account, one Facebook profile, and so on. Any one of these identifiers is enough to sign the player into the same account, from any device.

With a social provider, you obtain an OAuth or access token from the service and pass it to Nakama. Nakama verifies the token with the provider, fetches the player’s profile, and resolves it to the account that owns that social ID, creating one on first sign-in. More at Social providers .

Two operations manage the identifiers on an account:

• Authenticate signs the player in. Nakama finds the account that owns the identifier you pass, or creates one if none exists, and returns a session .
• Link attaches an additional identifier to the account the player is already signed into. It returns nothing and leaves the current session unchanged.

Linking has two constraints worth knowing up front: linking an identifier that already belongs to another account returns a 409, and unlinking an account’s only remaining identifier returns a 403. Both are covered in Link or unlink .

Ways to associate an identifier #

Because any linked identifier resolves to the same account, you can combine authenticate and link into more than one valid pathway, depending on which identifier the player has first:

• Device ID first, social ID linked later: authenticate with a device ID, then link a social ID once the player signs in with one, from a settings menu or an in-game prompt.
• Social ID first, device ID linked after: authenticate with a social provider such as Game Center or Google Play Games, then link the device ID so the same fallback resolves to this account on future launches.

The silent social sign-in guide walks through the social-ID-first pathway end to end.

Authentication methods #

Nakama supports a range of authentication methods: device ID, email, several social providers, and custom identifiers. Each method produces a session token that gives the client access to the server.

By default, authenticating with an identifier that doesn’t yet exist in the system will automatically create a new user account. To authenticate without creating an account, set create to false.

For full SDK examples, see the client library guides .

Device #

A device identifier can be used as a way to unobtrusively register a user with the server. This offers a frictionless user experience but can be unreliable because device identifiers can sometimes change in device updates.

Don’t use OS-level hardware identifiers (such as OS.get_unique_id() in Godot) as these are accessible to other apps on the device and could let them authenticate as your users. Instead, generate a secure random UUID on first launch and store it in your app’s private local storage. The examples below demonstrate this approach.

You can choose a custom username when creating the account. To do this, set username to a custom name. If you want to only authenticate without implicitly creating a user account, set create to false.

A device identifier must contain alphanumeric characters with dashes and be between 10 and 128 bytes.

1
2
3

curl "http://127.0.0.1:7350/v2/account/authenticate/device?create=true&username=mycustomusername" \
  --user 'defaultkey:' \
  --data '{"id":"uniqueidentifier"}'

1
2
3
4
5
6
7
8

POST /v2/account/authenticate/device?create=true&username=mycustomusername
Host: 127.0.0.1:7350
Accept: application/json
Content-Type: application/json
Authorization: Basic base64(ServerKey:)
{
  "id": "uniqueidentifier"
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27

// This import is only required with React Native
var deviceInfo = require("react-native-device-info");
var deviceId = null;

try {
  const value = await AsyncStorage.getItem("@MyApp:deviceKey");

  if (value !== null) {
    deviceId = value;
  } else {
    deviceId = deviceInfo.getUniqueID();

    AsyncStorage.setItem("@MyApp:deviceKey", deviceId).catch(function (error) {
      console.log("An error occurred: %o", error);
    });
  }
} catch (error) {
  console.log("An error occurred: %o", error);
}

var create = true;
const session = await client.authenticateDevice(
  deviceId,
  create,
  "mycustomusername",
);
console.info("Successfully authenticated:", session);

1
2
3
4

// Should use a platform API to obtain a device identifier.
var deviceId = System.Guid.NewGuid().ToString();
var session = await client.AuthenticateDeviceAsync(deviceId);
System.Console.WriteLine("New user: {0}, {1}", session.Created, session);

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12

auto loginFailedCallback = [](const NError& error)
{
};

auto loginSucceededCallback = [](NSessionPtr session)
{
    cout << "Successfully authenticated" << endl;
};

std::string deviceId = "unique device id";

client->authenticateDevice(deviceId, opt::nullopt, opt::nullopt, {}, loginSucceededCallback, loginFailedCallback);

1
2
3

String id = UUID.randomUUID().toString();
Session session = client.authenticateDevice(id).get();
System.out.format("Session: %s ", session.getAuthToken());

1
2
3
4
5
6
7
8
9

# Unique ID is not supported by Godot in HTML5, use a different way to generate an id, or a different authentication option.
var deviceid = OS.get_unique_id()
var session : NakamaSession = yield(client.authenticate_device_async(deviceid), "completed")

if session.is_exception():
    print("An error occurred: %s" % session)
    return

print("Successfully authenticated: %s" % session)

1
2
3
4
5
6
7

var session : NakamaSession = await client.authenticate_device_async(Nakama.get_device_id())

if session.is_exception():
    print("An error occurred: %s" % session)
    return

print("Successfully authenticated: %s" % session)

 1
 2
 3
 4
 5
 6
 7
 8
 9
10

-- login using the token and create an account if the user
-- doesn't already exist
local result = client.authenticate_device(defold,uuid(), nil, true, "mycustomusername")

if not result.token then
  print("Unable to login")
end

-- store the token and use it when communicating with the server
client.set_bearer_token(result.token)

1
2
3
4
5
6
7
8

guard let deviceId = await UIDevice.current.identifierForVendor?.uuidString else { return }

do {
    let session = try await client.authenticateDevice(id: deviceId, create: create, username: "mycustomusername")
    print("Successfully authenticated:", session)
} catch {
    debugPrint(error)
}

1
2

// You can obtain device id for multiplatforms using a package like `device_info_plus`
final session = await client.authenticateDevice(deviceId: '<obtained_device_id>');

In games it is often a better option to use Google or Game Center to unobtrusively register the user.

Email #

Users can be registered with an email and password. The password is hashed before it’s stored in the database server and cannot be read or “recovered” by administrators. This protects a user’s privacy.

You can choose a custom username when creating the account. To do this, set username to a custom name. If you want to only authenticate without implicitly creating a user account, set create to false.

An email address must be valid as defined by RFC-5322 and passwords must be at least 8 characters.

Once an account has been created with email + password (and optionally a username), you may also authenticate with username + password using the same email authentication endpoint (or SDK function). In this case, pass the email argument as an empty string ("").

1
2
3

curl "http://127.0.0.1:7350/v2/account/authenticate/email?create=true&username=mycustomusername" \
  --user 'defaultkey:' \
  --data '{"email":"email@example.com", "password": "3bc8f72e95a9"}'

1
2
3
4
5
6
7
8
9

POST /v2/account/authenticate/email?create=true&username=mycustomusername
Host: 127.0.0.1:7350
Accept: application/json
Content-Type: application/json
Authorization: Basic base64(ServerKey:)
{
  "email": "email@example.com",
  "password": "3bc8f72e95a9"
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18

const email = "email@example.com";
const password = "3bc8f72e95a9";
const create = true;
const session = await client.authenticateEmail(
  email,
  password,
  create,
  "mycustomusername",
);
console.info("Successfully authenticated:", session);

// Alternatively, authenticate with username + password only:
const session2 = await client.authenticateEmail(
  "",
  password,
  false,
  "mycustomusername",
);

1
2
3
4
5
6
7

const string email = "email@example.com";
const string password = "3bc8f72e95a9";
var session = await client.AuthenticateEmailAsync(email, password);
System.Console.WriteLine("New user: {0}, {1}", session.Created, session);

// Alternatively, authenticate with username + password only:
var session2 = await client.AuthenticateEmailAsync("", password, "mycustomusername", false);

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18

auto successCallback = [](NSessionPtr session)
{
    std::cout << "Authenticated successfully. User ID: " << session->getUserId() << std::endl;
};

auto errorCallback = [](const NError& error)
{
};

string email = "email@example.com";
string password = "3bc8f72e95a9";
string username = "mycustomusername";
bool create = true;
client->authenticateEmail(email, password, username, create, {}, successCallback, errorCallback);


// Alternatively, authenticate with username + password only:
client->authenticateEmail("", password, username, false, {}, successCallback, errorCallback);

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12

String email = "email@example.com";
String password = "3bc8f72e95a9";
Session session = client.authenticateEmail(email, password).get();
System.out.format("Session: %s ", session.getAuthToken());

// Alternatively, authenticate with username + password only:
Session session2 = client.authenticateEmail(
  "",                    // email empty
  password,
  "mycustomusername",    // username
  false                  // create = false (authenticate only)
).get();

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15

var email = "email@example.com"
var password = "3bc8f72e95a9"
var session : NakamaSession = yield(client.authenticate_email_async(email, password, "mycustomusername", true), "completed")

if session.is_exception():
    print("An error occurred: %s" % session)
    return

print("Successfully authenticated: %s" % session)

# Alternatively, authenticate with username + password only:
var session2 : NakamaSession = yield(
  client.authenticate_email_async("", password, "mycustomusername", false),
  "completed"
)

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17

var email = "email@example.com"
var password = "3bc8f72e95a9"
var session : NakamaSession = await client.authenticate_email_async(email, password, "mycustomusername", true)

if session.is_exception():
    print("An error occurred: %s" % session)
    return

print("Successfully authenticated: %s" % session)

# Alternatively, authenticate with username + password only:
var session2 : NakamaSession = await client.authenticate_email_async(
  "",                     # email empty
  password,
  "mycustomusername",
  false                   # create = false
)

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12

local result = client.authenticate_email("email@example.com", "3bc8f72e95a9", nil, true, "mycustomusername")

if not result.token then
  print("Unable to login")
end

-- store the token and use it when communicating with the server
client.set_bearer_token(result.token)

-- Alternatively, authenticate with username + password only:
local result2 = client.authenticate_email("", "3bc8f72e95a9", nil, false, "mycustomusername")

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20

do {
    let session = try await client.authenticateEmail(email: "email", password: "password", create: true, username: "mycustomusername")
    print("Successfully authenticated:", session)
} catch {
    debugPrint(error)
}

// Alternatively, authenticate with username + password only:
do {
    let session2 = try await client.authenticateEmail(
        email: "",
        password: "password",
        create: false,             // authenticate only
        username: "mycustomusername"
    )
    print("Successfully authenticated:", session2)
} catch {
    debugPrint(error)
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24

try {
  session = await client.authenticateEmail(
    email: 'email',
    password: 'password',
    create: true,
    username: 'mycustomusername',
  );
  print('Successfully authenticated: $session');
} catch (error) {
  print(error);
}

// Alternatively, authenticate with username + password only:
try {
  final session2 = await client.authenticateEmail(
    email: '',
    password: 'password',
    create: false,              // authenticate only
    username: 'mycustomusername',
  );
  print('Successfully authenticated: $session2');
} catch (error) {
  print(error);
}

Console #

Nakama supports console authentication for all major platforms, including Nintendo Switch, Xbox One and Series X|S, and PlayStation 4/5.

The console authentication flow is similar to the device authentication flow, but requires a console identifier and a console user identifier.

Note that the examples below are only meant to be illustrative. Complete documentation can only be provided following your verification by the console platform provider(s).

1
2
3
4
5
6
7
8

// Xbox authentication
var session = await client.AuthenticateCustomAsync("xbox|<xbox_code>");

// PlayStation authentication
var session = await client.AuthenticateCustomAsync("psn|<<psn_code>>");

// Nintendo authentication
var session = await client.AuthenticateCustomAsync("nintendo|<<nintendo_code>>");

1
2
3
4
5
6
7
8

// Xbox authentication
client->authenticateCustom("xbox|<xbox_code>", {}, successCallback, errorCallback);

// PlayStation authentication
client->authenticateCustom("psn|<<psn_code>>", {}, successCallback, errorCallback);

// Nintendo authentication
client->authenticateCustom("nintendo|<<nintendo_code>>", {}, successCallback, errorCallback);

Social providers #

The server supports a lot of different social services with register and login. With each provider the user account will be fetched from the social service and used to setup the user. In some cases a user’s friends will also be fetched and added to their friends list.

To register or login as a user with any of the providers an OAuth or access token must be obtained from that social service.

When a social login fails, the client receives a generic message such as Could not authenticate Google profile., while the provider’s specific reason (for example, an invalid or expired token) is written to the server log. For how to debug these, see Social authentication errors .

Apple #

Follow the Apple Developer documentation for integrating Sign in with Apple in your applications.

You can choose a custom username when creating the account. To do this, set username to a custom name. If you want to only authenticate without implicitly creating a user account, set create to false.

1
2
3

curl "http://127.0.0.1:7350/v2/account/authenticate/apple?create=true&username=mycustomusername" \
  --user 'defaultkey:' \
  --data '{"token":"..."}'

1
2
3
4
5
6
7
8

POST /v2/account/authenticate/apple?create=true&username=mycustomusername
Host: 127.0.0.1:7350
Accept: application/json
Content-Type: application/json
Authorization: Basic base64(ServerKey:)
{
  "token": "...",
}

1
2
3
4
5

const token = "...";
const create = true;
const username = "...";
const session = await client.authenticateApple(token, create, username);
console.info("Successfully authenticated: %o", session);

1
2
3
4
5

var username = "...";
var token = "...";

var session = await client.AuthenticateAppleAsync(token, username);
System.Console.WriteLine("New user: {0}, {1}", session.Created, session);

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13

auto successCallback = [](NSessionPtr session)
{
    std::cout << "Authenticated successfully. User ID: " << session->getUserId() << std::endl;
};

auto errorCallback = [](const NError& error)
{
};

std::string username = "...";
std::string token = "...";

client->authenticateApple(token, username);

 1
 2
 3
 4
 5
 6
 7
 8
 9
10

var username = "..."
var token = "..."

var session : NakamaSession = yield(client.authenticate_apple_async(token, username), "completed")

if session.is_exception():
    print("An error occurred: %s" % session)
    return

print("Successfully authenticated: %s" % session)

 1
 2
 3
 4
 5
 6
 7
 8
 9
10

var username = "..."
var token = "..."

var session : NakamaSession = await client.authenticate_apple_async(token, username)

if session.is_exception():
    print("An error occurred: %s" % session)
    return

print("Successfully authenticated: %s" % session)

{

1
2
3

String token = "...";
Session session = client.authenticateApple(token).get();
System.out.format("Session %s", session.getAuthToken());

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11

-- Use https://defold.com/assets/siwa/
local token = "..."
local username = "..."
local result = client.authenticate_apple(token, username)

if not result.token then
  print("Unable to login")
end

-- store the token and use it when communicating with the server
client.set_bearer_token(result.token)

1
2
3
4
5
6
7
8
9

let oauthToken = "<token>"
var username = "..."

do {
    let session = try await client.authenticateApple(oauthToken: oauthToken, username: "mycustomusername")
    print("Successfully authenticated:", session)
} catch {
    debugPrint(error)
}

1
2
3
4
5
6
7

final oauthToken = '<token>';
final username = '...';

final session = await client.authenticateApple(
  token: oauthToken,
  username: 'mycustomusername',
);

Game Center #

Game Center provides built-in authentication on Apple devices without requiring user interaction. To authenticate, pass the player credentials provided by Apple’s GameKit framework.

You can choose a custom username when creating the account. To do this, set username to a custom name. If you want to only authenticate without implicitly creating a user account, set create to false.

1
2
3
4
5
6
7
8

String playerId = "...";
String bundleId = "...";
Long timestampSeconds = <...>;
String salt = "...";
String signature = "...";
String publicKeyUrl = "...";
Session session = client.authenticateGameCenter(playerId, bundleId, timestampSeconds, salt, signature, publicKeyUrl).get();
System.out.format("Session %s", session.getAuthToken());

1
2
3

curl "http://127.0.0.1:7350/v2/account/authenticate/gamecenter?create=true&username=mycustomusername" \
  --user 'defaultkey:' \
  --data '{"player_id":"...", "bundle_id":"...", "timestamp_seconds":0, "salt":"...", "public_key_url":"..."}'

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13

POST /v2/account/authenticate/gamecenter?create=true&username=mycustomusername
Host: 127.0.0.1:7350
Accept: application/json
Content-Type: application/json
Authorization: Basic base64(ServerKey:)
{
  "player_id": "...",
  "bundle_id": "...",
  "timestamp_seconds": 0,
  "salt": "...",
  "signature": "...",
  "public_key_url": "..."
}

1
2
3
4
5
6
7
8
9

var bundleId = "...";
var playerId = "...";
var publicKeyUrl = "...";
var salt = "...";
var signature = "...";
var timestamp = "...";
var session = await client.AuthenticateGameCenterAsync(bundleId, playerId,
    publicKeyUrl, salt, signature, timestamp);
System.Console.WriteLine("New user: {0}, {1}", session.Created, session);

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15

const bundleId = "...";
const playerId = "...";
const publicKeyUrl = "...";
const salt = "...";
const signature = "...";
const timestamp = "...";
const session = await client.authenticateGameCenter(
  bundleId,
  playerId,
  publicKeyUrl,
  salt,
  signature,
  timestamp,
);
console.info("Successfully authenticated: %o", session);

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17

auto successCallback = [](NSessionPtr session)
{
    std::cout << "Authenticated successfully. User ID: " << session->getUserId() << std::endl;
};

auto errorCallback = [](const NError& error)
{
};

std::string playerId = "...";
std::string    bundleId = "...";
NTimestamp timestampSeconds = "...";
std::string salt = "...";
std::string signature = "...";
std::string publicKeyUrl = "...";

client->authenticateGameCenter(playerId, bundleId, timestampSeconds, salt, signature, publicKeyUrl, "mycustomusername", true, {}, successCallback, errorCallback);

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13

var bundle_id = "..."
var player_id = "..."
var public_key_url = "..."
var salt = "..."
var signature = "..."
var timestamp = "..."
var session : NakamaSession = yield(client.authenticate_game_center_async(bundle_id, player_id, public_key_url, salt, signature, timestamp), "completed")

if session.is_exception():
    print("An error occurred: %s" % session)
    return

print("Successfully authenticated: %s" % session)

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13

var bundle_id = "..."
var player_id = "..."
var public_key_url = "..."
var salt = "..."
var signature = "..."
var timestamp = "..."
var session : NakamaSession = await client.authenticate_game_center_async(bundle_id, player_id, public_key_url, salt, signature, timestamp)

if session.is_exception():
    print("An error occurred: %s" % session)
    return

print("Successfully authenticated: %s" % session)

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15

-- Use https://defold.com/assets/gamekit/
local bundle_id = "..."
local player_id = "..."
local public_key_url = "..."
local salt = "..."
local signature = "..."
local timestamp_seconds = 0
local result = client.authenticate_game_center(bundle_id, player_id, public_key_url, salt, signature, timestamp_seconds, nil, true, "mycustomusername")

if not result.token then
  print("Unable to login")
end

-- store the token and use it when communicating with the server
client.set_bearer_token(result.token)

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14

let playerId = "<playerId>"
var bundleId = "<bundleId>"
var timestampSeconds = <timestampSeconds>
var salt = "<salt>"
var signature = "<signature>"
var publicKeyUrl = "<publicKeyUrl>"
var create = true

do {
    let session = try await client.authenticateGameCenter(playerId: playerId, bundleId: bundleId, timestampSeconds: timestampSeconds, salt: salt, signature: signature, publicKeyUrl: publicKeyUrl, create: create, username: "mycustomusername")
    print("Successfully authenticated:", session)
} catch {
    debugPrint(error)
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18

final playerId = '<playerId>';
final bundleId = '<bundleId>';
final timestampSeconds = DateTime.now().millisecondsSinceEpoch ~/ 1000;
final salt = '<salt>';
final signature = '<signature>';
final publicKeyUrl = '<publicKeyUrl>';
final create = true;

final session = await client.authenticateGameCenter(
  playerId: playerId,
  bundleId: bundleId,
  timestampSeconds: timestampSeconds,
  salt: salt,
  signature: signature,
  publicKeyUrl: publicKeyUrl,
  create: create,
  username: 'mycustomusername',
);

Facebook #

With Facebook you’ll need to add the Facebook SDK to your project which can be downloaded online. Follow their guides on how to integrate the code. With a mobile project you’ll also need to complete instructions on how to configure iOS and Android.

You can choose a custom username when creating the account. To do this, set username to a custom name. If you want to only authenticate without implicitly creating a user account, set create to false.

When authenticating via Facebook, the following profile fields are fetched and stored in the user account:

• ID
• Name
• Email
• Photo

Additionally, you can optionally import Facebook friends into Nakama’s friend graph when authenticating. To do this, set import to true.

1
2
3

curl "http://127.0.0.1:7350/v2/account/authenticate/facebook?create=true&username=mycustomusername&import=true" \
    --user 'defaultkey:' \
    --data '{"token":"valid-oauth-token"}' # Supports the use of both OAuth and Facebook Limited Login (JWT) tokens.

1
2
3
4
5
6
7
8

POST /v2/account/authenticate/facebook?create=true&username=mycustomusername&import=true
Host: 127.0.0.1:7350
Accept: application/json
Content-Type: application/json
Authorization: Basic base64(ServerKey:)
{
  "token": "...",
}

1
2
3
4

const oauthToken = "...";
const import = true;
const session = await client.authenticateFacebook(oauthToken, true, "mycustomusername", import);
console.log("Successfully authenticated:", session);

1
2
3

const string oauthToken = "...";
var session = await client.AuthenticateFacebookAsync(oauthToken);
System.Console.WriteLine("New user: {0}, {1}", session.Created, session);

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12

auto loginFailedCallback = [](const NError& error)
{
};

auto loginSucceededCallback = [](NSessionPtr session)
{
    cout << "Authenticated successfully. User ID: " << session->getUserId() << endl;
};

std::string oauthToken = "...";
bool importFriends = true;
client->authenticateFacebook(oauthToken, "mycustomusername", true, importFriends, {}, loginSucceededCallback, loginFailedCallback);

1
2
3

String oauthToken = "...";
Session session = client.authenticateFacebook(oauthToken).get();
System.out.format("Session %s", session.getAuthToken());

1
2
3
4
5
6
7
8

var oauth_token = "..."
var session : NakamaSession = yield(client.authenticate_facebook_async(oauth_token), "completed")

if session.is_exception():
    print("An error occurred: %s" % session)
    return

print("Successfully authenticated: %s" % session)

1
2
3
4
5
6
7
8

var oauth_token = "..."
var session : NakamaSession = await client.authenticate_facebook_async(oauth_token)

if session.is_exception():
    print("An error occurred: %s" % session)
    return

print("Successfully authenticated: %s" % session)

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14

-- Use the official Defold Facebook integration (www.defold.com/extension-facebook)
local permissions = { "public_profile" }
-- login using read permissions
-- there is no need to specify a publishing audience when requesting read permissions
facebook.login_with_permissions(permissions, facebook.AUDIENCE_NONE, function(self, data)
  local result = client.authenticate_facebook(facebook.access_token(), nil, true, "mycustomusername")

  if not result.token then
    print("Unable to login")
    return
  end
  -- store the token and use it when communicating with the server
  client.set_bearer_token(result.token)
end)

1
2
3
4
5
6
7
8
9

let oauthToken = "<token>"
var importFriends = true

do {
    let session = try await client.authenticateFacebook(accessToken: oauthToken, create: true, username: "mycustomusername", importFriends: importFriends)
    print("Successfully authenticated:", session)
} catch {
    debugPrint(error)
}

1
2
3
4
5
6
7
8
9

final oauthToken = '<token>';
final importFriends = true;

final session = await client.authenticateFacebook(
  token: oauthToken,
  create: true,
  username: 'mycustomusername',
  importFriends: importFriends,
);

Facebook Instant #

Ensure that you’ve configured your FB Instant App secret for Nakama and initialized the Facebook Instant Games SDK using FBInstant.initializeAsync().

1
2
3

curl "http://127.0.0.1:7350/v2/account/authenticate/facebookinstantgame?create=true&username=mycustomusername" \
    --user 'defaultkey:' \
    --data '{"token":"valid-oauth-token"}' # Supports the use of both OAuth and Facebook Limited Login (JWT) tokens.

1
2
3
4
5

const result = await FBInstant.player.getSignedPlayerInfoAsync();
var session = await client.authenticateFacebookInstantGame(
  result.getSignature(),
);
console.info("Successfully authenticated: %o", session);

1
2
3

String accessToken = "...";
Session session = client.authenticateFacebookInstant(accessToken).get();
System.out.format("Session %s", session.getAuthToken());

1
2
3
4
5
6
7
8

var signed_player_info = "..."
var session : NakamaSession = yield(client.authenticate_facebook_instant_game_async(signed_player_info), "completed")

if session.is_exception():
    print("An error occurred: %s" % session)
    return

print("Successfully authenticated: %s" % session)

1
2
3
4
5
6
7
8

var signed_player_info = "..."
var session : NakamaSession = await client.authenticate_facebook_instant_game_async(signed_player_info)

if session.is_exception():
    print("An error occurred: %s" % session)
    return

print("Successfully authenticated: %s" % session)

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11

-- Use the official Defold Facebook Instant Games integration (www.defold.com/extension-fbinstant)
fbinstant.get_signed_player_info("developer payload", function(self, signature)
  local result = client.authenticate_facebook_instant_game(signature, nil, true, "mycustomusername")

  if not result.token then
    print("Unable to login")
    return
  end
  -- store the token and use it when communicating with the server
  client.set_bearer_token(result.token)
end)

1
2
3
4
5
6
7
8

let token = "<token>"

do {
    let session = try await client.authenticateFacebookInstantGame(token: token, create: true, username: "mycustomusername")
    print("Successfully authenticated:", session)
} catch {
    debugPrint(error)
}

1
2
3
4
5
6
7

final token = '<token>';

final session = await client.authenticateFacebookInstantGame(
  signedPlayerInfo: token,
  create: true,
  username: 'mycustomusername',
);

Google #

Nakama supports two Google authentication flows through the same endpoint (/v2/account/authenticate/google) and SDK method (AuthenticateGoogleAsync). The credential type you pass determines which flow is used:

• Google Sign-In: Pass the ID token (JWT) from the Google Sign-In SDK .
• Play Game Services (PGS) v2: Pass the server-side auth code from the Play Games SDK. Requires additional Nakama server configuration (see below)

You can choose a custom username when creating the account. To do this, set username to a custom name. If you want to only authenticate without implicitly creating a user account, set create to false.

Google Sign-In #

Pass the ID token returned by the Google Sign-In SDK as the token parameter:

1
2
3

curl "http://127.0.0.1:7350/v2/account/authenticate/google?create=true&username=mycustomusername" \
  --user 'defaultkey:' \
  --data '{"token":"valid-oauth-token"}'

1
2
3
4
5
6
7
8

POST /v2/account/authenticate/google?create=true&username=mycustomusername
Host: 127.0.0.1:7350
Accept: application/json
Content-Type: application/json
Authorization: Basic base64(ServerKey:)
{
  "token": "...",
}

1
2
3
4
5
6
7
8

const playerIdToken = "...";
const create = true;
const session = await client.authenticateGoogle(
  oauthToken,
  create,
  "mycustomusername",
);
console.info("Successfully authenticated: %o", session);

1
2
3

const string playerIdToken = "...";
var session = await client.AuthenticateGoogleAsync(playerIdToken);
System.Console.WriteLine("New user: {0}, {1}", session.Created, session);

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11

auto successCallback = [](NSessionPtr session)
{
    std::cout << "Authenticated successfully. User ID: " << session->getUserId() << std::endl;
};

auto errorCallback = [](const NError& error)
{
};

string oauthToken = "...";
client->authenticateGoogle(oauthToken, "mycustomusername", true, {}, successCallback, errorCallback);

1
2
3

String accessToken = "...";
Session session = client.authenticateGoogle(accessToken).get();
System.out.format("Session %s", session.getAuthToken());

1
2
3
4
5
6
7
8

var oauth_token = "..."
var session : NakamaSession = yield(client.authenticate_google_async(oauth_token), "completed")

if session.is_exception():
    print("An error occurred: %s" % session)
    return

print("Successfully authenticated: %s" % session)

1
2
3
4
5
6
7
8

var oauth_token = "..."
var session : NakamaSession = await client.authenticate_google_async(oauth_token)

if session.is_exception():
    print("An error occurred: %s" % session)
    return

print("Successfully authenticated: %s" % session)

1
2
3
4
5
6
7
8

local result = client.authenticate_google(oauth_token, nil, true, "mycustomusername")

if not result.token then
  print("Unable to login")
end

-- store the token and use it when communicating with the server
client.set_bearer_token(result.token)

Play Game Services (PGS) #

PGS v1 is deprecated; use PGS v2. PGS v2 uses server-side access: the client obtains a server-side auth code from the Play Games SDK, which Nakama exchanges for credentials on the server. Pass this server-side auth code as the token parameter. The SDK call is otherwise identical to Google Sign-In above.

Because the exchange happens server-side, Nakama must be configured with credentials that authorize it to call the Play Games API. Obtain the credentials JSON from your Play Games server-side setup — these must include read scopes for the Players:get endpoint . These credentials are separate from any service account used for IAP validation .

Steam #

Steam requires you to configure the server before you can register a user. Have a look at the configuration section for what settings you need for the server.

You can choose a custom username when creating the account. To do this, set username to a custom name. If you want to only authenticate without implicitly creating a user account, set create to false.

You can optionally import Steam friends into Nakama’s friend graph when authenticating. To do this, set import to true.

1
2
3

curl "http://127.0.0.1:7350/v2/account/authenticate/steam?create=true&username=mycustomusername&import=true" \
  --user 'defaultkey:' \
  --data '{"token":"valid-steam-token"}'

1
2
3
4
5
6
7
8

POST /v2/account/authenticate/steam?create=true&username=mycustomusername&import=true
Host: 127.0.0.1:7350
Accept: application/json
Content-Type: application/json
Authorization: Basic base64(ServerKey:)
{
  "token": "...",
}

1
2
3
4
5
6

const token = "...";
const create = true;
const username = "...";
const sync = true;
const session = await client.authenticateSteam(token, create, username, sync);
console.info("Successfully authenticated: %o", session);

1
2
3
4

const string token = "...";
const bool importFriends = true;
var session = await client.AuthenticateSteamAsync(token, importFriends);
System.Console.WriteLine("New user: {0}, {1}", session.Created, session);

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14

auto successCallback = [](NSessionPtr session)
{
    std::cout << "Authenticated successfully. User ID: " << session->getUserId() << std::endl;
};

auto errorCallback = [](const NError& error)
{
};

string token = "...";
string username = "mycustomusername";
bool create = true;
bool importFriends = true;
client->authenticateSteam(token, username, create, importFriends, {}, successCallback, errorCallback);