Player & Authentication

The Y8 SDK provides authentication and player account functionality for Y8 games.

Players can sign in and out, retrieve their profile information, manage authentication tokens, and—when required—verify player identity with your own backend.

SDK initialization

The examples on this page assume that the Y8 SDK has already been initialized.

Authenticate the current player.

JavaScriptUnityConstruct 3Haxe

y8Sdk.login();

If authentication succeeds, the onAuth() callback receives the authenticated player.

JsResponse<Y8User> response = await Y8.Instance.LoginAsync();

if (response.IsSuccess)
{
    Debug.Log($"Logged in as {response.Data.nickname}");
}

Call login() from your Construct 3 Event Sheet.

login();

For example, call Login when the player clicks your Login button.

Login

Y8.login();

If authentication succeeds, the callback provided during Y8.init() is invoked with the updated authentication state.

Logout

Sign the current player out of your game.

JavaScriptUnityConstruct 3Haxe

y8Sdk.logout();

Logging out also clears locally stored authentication data.

await Y8.Instance.LogoutAsync();

Call logout() from your Construct 3 Event Sheet.

logout();

After logout, the C3 authentication state is updated and isLogin becomes false.

Logout

Y8.logout();

After signing out, the authentication callback is invoked with the updated authentication state.

Authentication State

Use the authentication callbacks or state provided by your engine to update your game's UI.

JavaScriptUnityConstruct 3Haxe

Register an authentication callback:

y8Sdk.onAuth((user, error) => {
    if (error) {
        console.error(error);
        return;
    }

    console.log(user);
});

The callback is triggered whenever the player's authentication state changes.

Subscribe to authentication errors:

private void OnEnable()
{
    Y8.Instance.OnAuthError += HandleAuthError;
}

private void OnDisable()
{
    Y8.Instance.OnAuthError -= HandleAuthError;
}

private void HandleAuthError(AuthError error)
{
    Debug.LogError($"Authentication failed: {error.message}");
}

Use the isLogin and userNameY8 global variables.

isLogin = true
    → Player is authenticated
    → Use userNameY8 to display the player's name

isLogin = false
    → Player is not authenticated
    → Display Guest or your login UI

Provide an authentication callback when initializing the SDK:

Y8.init(appId, gameId, updateAuthUI);

private function updateAuthUI(
    loggedIn:Bool,
    username:String
):Void
{
    if (loggedIn)
    {
        trace("Welcome " + username);
    }
    else
    {
        trace("Player is not signed in.");
    }
}

Get Current Player

Retrieve the currently authenticated player's profile.

JavaScriptUnityConstruct 3Haxe

const user = y8Sdk.getUser();

console.log(user);

Returns null when nobody is signed in.

Property	Type	Description
`pid`	`string`	Player identifier.
`nickname`	`string`	Display name.
`level`	`number`	Y8 account level.
`avatars`	`object`	Avatar URLs — see below.

avatars holds several sizes, each with a plain and a secure variant: thumb_url, thumb_secure_url, medium_url, medium_secure_url, large_url, large_secure_url. Prefer the secure ones.

const user = y8Sdk.getUser();

if (user) {
    showName(user.nickname);
    showAvatar(user.avatars.medium_secure_url);
}

The server may include fields beyond these; treat anything not listed as subject to change.

This is display data, not proof of identity

Everything here lives in the player's browser and can be edited by whoever is playing — the pid included. Use it to greet someone by name and show their avatar.

If your game has its own backend, never send this pid to it as identity. See Verifying Players.

JsResponse<Y8User> response =
    await Y8.Instance.GetUserAsync();

if (response.IsSuccess)
{
    Debug.Log(response.Data.nickname);
}

A synchronous version is also available:

Y8User user = Y8.Instance.GetUser();

if (user != null)
{
    Debug.Log(user.nickname);
}

Returns null when nobody is signed in.

Property	Type	Description
`pid`	`string`	Player identifier.
`nickname`	`string`	Display name.
`level`	`number`	Y8 account level.
`avatars`	`object`	Avatar URLs — see below.

avatars holds several sizes, each with a plain and a secure variant: thumb_url, thumb_secure_url, medium_url, medium_secure_url, large_url, large_secure_url. Prefer the secure ones.

const user = y8Sdk.getUser();

if (user) {
    showName(user.nickname);
    showAvatar(user.avatars.medium_secure_url);
}

The server may include fields beyond these; treat anything not listed as subject to change.

This is display data, not proof of identity

Everything here lives in the player's browser and can be edited by whoever is playing — the pid included. Use it to greet someone by name and show their avatar.

If your game has its own backend, never send this pid to it as identity. See Verifying Players.

getUser();

You can store the returned player data in a Construct 3 variable.

GetUserBtn → On clicked
           → Set y8UserData to Functions.getUser

Returns null when nobody is signed in.

Property	Type	Description
`pid`	`string`	Player identifier.
`nickname`	`string`	Display name.
`level`	`number`	Y8 account level.
`avatars`	`object`	Avatar URLs — see below.

avatars holds several sizes, each with a plain and a secure variant: thumb_url, thumb_secure_url, medium_url, medium_secure_url, large_url, large_secure_url. Prefer the secure ones.

const user = y8Sdk.getUser();

if (user) {
    showName(user.nickname);
    showAvatar(user.avatars.medium_secure_url);
}

The server may include fields beyond these; treat anything not listed as subject to change.

This is display data, not proof of identity

Everything here lives in the player's browser and can be edited by whoever is playing — the pid included. Use it to greet someone by name and show their avatar.

If your game has its own backend, never send this pid to it as identity. See Verifying Players.

var user = Y8.getUser();

Returns null when nobody is signed in.

Property	Type	Description
`pid`	`string`	Player identifier.
`nickname`	`string`	Display name.
`level`	`number`	Y8 account level.
`avatars`	`object`	Avatar URLs — see below.

avatars holds several sizes, each with a plain and a secure variant: thumb_url, thumb_secure_url, medium_url, medium_secure_url, large_url, large_secure_url. Prefer the secure ones.

const user = y8Sdk.getUser();

if (user) {
    showName(user.nickname);
    showAvatar(user.avatars.medium_secure_url);
}

The server may include fields beyond these; treat anything not listed as subject to change.

This is display data, not proof of identity

Everything here lives in the player's browser and can be edited by whoever is playing — the pid included. Use it to greet someone by name and show their avatar.

If your game has its own backend, never send this pid to it as identity. See Verifying Players.

Reload Player

Refresh the player's information from Y8.

JavaScriptUnityConstruct 3Haxe

y8Sdk.reloadUser()
    .then((user) => {
        console.log(user);
    })
    .catch((error) => {
        console.error(error);
    });

JsResponse<Y8User> response =
    await Y8.Instance.ReloadUserAsync();

if (response.IsSuccess)
{
    Debug.Log(response.Data.nickname);
}

reloadUser();

After the player information is reloaded, the onUserReloaded function is triggered.

On function onUserReloaded
    → Use userdata

Y8.reloadUser();

Use this method when your game needs the latest player information after account changes.

Authentication Tokens

Authentication tokens allow your game to securely authenticate the player.

Get Token

Retrieve the current authentication token.

JavaScriptUnityConstruct 3Haxe

const token = y8Sdk.getToken();

JsResponse<Y8Token> response =
    await Y8.Instance.GetTokenAsync();

if (response.IsSuccess)
{
    Debug.Log(response.Data.token_type);
}

A synchronous version is also available:

Y8Token token = Y8.Instance.GetToken();

if (token != null)
{
    Debug.Log(token.token_type);
}

getToken();

getToken

You can store the returned token in a Construct 3 variable.

var token = Y8.getToken();

Refresh Token

Refresh the current authentication token.

JavaScriptUnityConstruct 3Haxe

y8Sdk.refreshToken()
    .then((token) => {
        console.log(token);
    })
    .catch((error) => {
        console.error(error);
    });

JsResponse<Y8Token> response = await Y8.Instance.RefreshTokenAsync();

refreshToken();

refreshToken

You can store the returned token in a Construct 3 variable.

Y8.refreshToken();

Get Access Token

The access token is what proves to your own server that a player is who they say they are. It is the only player-related value that is safe to send outside the SDK.

JavaScriptUnityConstruct 3Haxe

const accessToken = y8Sdk.getAccessToken();

Returns null when nobody is signed in, so call it once authentication has been reported.

Send this, not the full token

getToken() returns the whole token object, including the refresh token — a credential that can mint new access tokens and must never leave the SDK. getAccessToken() returns only the single string your server needs.

Sending the token is only half of it; your server then has to check it. See Verifying Players for what to do with it.

Not available on this platform — the bridge does not expose the access token to C#. See Verifying Players.

Not available on this platform — the integration does not expose the access token to the event sheet. See Verifying Players.

Not available on this platform — the wrapper does not expose the access token. See Verifying Players.