Authentication Methods

Stash provides three ways for players to sign in to your webshop. You can implement any combination of them.

Pre-authenticated links

Use a pre-authenticated link when the player starts in your game, for example by tapping a webshop button. The player opens the link and arrives in the webshop already signed in, with no sign-in step.

Your game server calls Generate authenticated URL (POST /sdk/server/generate_url) with the player's user.id and a target, and receives a url. Sign the request with your ingress secret, as described in HMAC signing. Pass the url to your game client, which opens it in the browser.

• target sets the webshop page the player lands on, for example STORE or LOYALTY.
• Each link signs a player in once and expires 30 minutes after it is generated. Generate a new link each time the player opens the webshop, and open it right away.
• user.regionCode is optional. When you send it, it must be a valid country code; an invalid value rejects the request.

Direct Sign in (SSO)

Players authenticate directly in the webshop using SSO providers such as Google, Apple, or Facebook.

You configure the providers in Stash Studio by adding their credentials. Players click Sign in, select a provider, and complete authentication in the browser.

Account Linking

With account linking, players authenticate by launching your game through a deep link on mobile or by scanning a QR code on desktop.

The deep link passes a session code to the game client. The client attaches the player's authentication data to the session code and sends both to Stash.

This method enables passwordless login by reusing the player's existing game session.