Do you develop casual games?

Focus on your game and quit rolling your own user authentication.

If you've been thinking about implementing OAuth, don't bother. It is way too complicated and doesn't meet the needs of a casual game anyhow.

We provide exactly what you need, no more, no less, and it's braindead easy to use. And we provide all the nuisance functionality to manage things like forgot password, logout, and verifying the account with either email or text message.

The Code

In your game's javascript simply call our authUser() method with no parameters (although you may optionally supply a config object). This method will return a JSON object with the user's information if the user is or can be logged in, or an error message if not. Note that this is asynchronous code so it either needs to be called from another async routine or from a module.

<script src="https://www.gexhub.net/js/gex.min.js"></script>

let res = GEX.authUser();
if(res.status == "ok") {
    alert(`Welcome ${res.username}`);
}
else {
    alert(`Login failed: ${res.message}`);
}

It's that easy.

The Return Value

The GEX.authUser() function returns an JSON object like so (pure JSON may not contain comments):

    {
        "status": "ok || error || pending",
        "message": "error message if status is error, otherwise a simple confirmation message",
        "data": {
            "username": "val",           // the user's chosen nickname, guaranteed unique
            "authkey": "text"            // the user's unique authkey, constant, may be used to identify the user in future calls
            "sessionkey": "text"         // the user's unique sessionkey, valid until the user logs out 
                                         // or logs in from somewhere else starting a new session
            "code": "int"                // the user's unique code, constant but guessable
            "lastLoginTime": "datetime", // the timestamp of the user's last login
            "anonymous": "bool",         // true if the user is logged in anonymously, false if the user has a registered account
        }
    }

username

The user's chosen nickname or a random generated anonymous name, 31 characters maximum. The username is guaranteed unique within GEXHUB.

authkey

A string of 24 random alphanumeric characters permanently associated with this user. You can assume a 1:1 relationship between this key and the username.

sessionkey

A string of 24 random alphanumeric characters semi-permanently associated with the user. This will remain constant unless the user chooses to sign out of all GEXHUB accounts.

code

This is an integer but it's actually the row number of this user in our database. It is potentially guessable since row IDs are assigned sequentially so it should be used in any public-facing way.

lastLoginTime

Thie date/time of the user's last login to GEX. The login could come from any site using GEX.

lastIpAddr

The last IP address the user logged in from, e.g. 101.102.103.104

anonymous

A boolean indicated this is an anonymous loging using a generated anonymous name.

The data fields identifying the user are not valid unless the status is "ok".

The config parameters

You may pass an optional config object to the GEX.authUser() function. The config object may contain the following fields:

    config = {
        playModes: {
            anonymous: true,
            private: false,
            registered: true
        },
        name: '',
        resetPassword: RESET_PASSWORD_URL
    };        

Server verification

The final piece of the puzzle is just that your server needs to pass the sessionkey to GEXHUB to verify the user. This is done by making a POST request to the following URL:

        https://www.gexhub.net/API/GetUserBySessionKey
    

You pass the sessionkey you received in the authUser() response in the body of the request as a JSON object like so:

        {
            "sessionkey": "the sessionkey you received from authUser()"
        }
    

This will return a JSON object with the same fields as the authUser() response, but with the status field set to "ok" if the sessionkey is valid, or "error" if it is not. You can then use this information to determine if the user is logged in and who they are.