Skip to main content
Before your game can call any protected endpoint, each player needs an account and a valid access token. PlaySmart handles authentication through two simple endpoints: POST /auth/register creates a new account and returns tokens immediately, and POST /auth/login does the same for returning players. Both return the same response shape, so your token-handling code only needs to be written once.
1

Register a new player

Call POST /auth/register with the player’s email address, a password of at least 8 characters, and a deviceId that uniquely identifies their device. The deviceId becomes the player’s auth_user_id and is used as the JWT sub claim on every subsequent request.
A successful registration returns HTTP 201 with the following body:
2

Store tokens securely

Save both tokens on the device immediately after registration or login.
  • access_token — valid for 30 days. Include this in the Authorization header on every authenticated request.
  • refresh_token — valid for 180 days. Use this to obtain a new access_token when the current one expires.
Store tokens in your platform’s secure credential store (for example, Android Keystore or iOS Keychain). Do not store them in plain shared preferences or PlayerPrefs.
3

Log in returning players

For a player who already has an account, call POST /auth/login with their email and password. No deviceId is needed here.
A successful login returns HTTP 200 with the same response shape as registration:
4

Use the access token

Add the access_token as a Bearer token in the Authorization header on every protected API call. All /v1/* and /ingest/* endpoints require this header.
If the token is missing or invalid, the API returns 401 UNAUTHORIZED.

​
Error handling