Authentication

Flock authentication has two layers, and the SDK handles both:

Game — the SDK authenticates your game with the credentials you configure once: the API Key, which game it is, and the Game Version. Every request it makes is then identified as your game.
Player — players sign in through the SDK, which then manages their session automatically for the rest of play.

Configure your game

Set your credentials in your engine’s settings. The editor resolves your Game Version, which the SDK needs before it can start, and can also verify the connection for you (an optional check).

Unity
Unreal

Credentials live in Flock → Settings, Configuration tab: Api Url, Api Key, Game Name (your game’s name from the dashboard) and Game Version — see Unity setup.With Auto-Initialize On Load the SDK authenticates as your game at startup; turn it off to initialize it yourself. Reach everything through FlockClient.Instance.

Credentials live in Project Settings → Plugins → Flock SDK Settings: API URL, API Key, Game Name (your game’s name from the dashboard) and Game Version — see Unreal setup.With Auto Initialize on Load the SDK authenticates as your game at startup; turn it off to initialize it yourself. Reach everything through UFlockSubsystem::Get(this), with "Flock" in your game module’s Build.cs.

Players sign in with one of several methods. Each resolves to the same player account, and the SDK keeps them signed in afterward.

Unity
Unreal

Every method is a LoginWith…Async call on FlockClient.Instance.Authentication. They throw FlockException on failure, so wrap them in try/catch to give bad credentials or a dead network a clean retry path. The examples run inside an async method; email, password and idToken are your own values. With no ID, the device calls use the device ID the SDK makes on the first launch and keeps for this install; Your first call says when to pass your own.

using Flock;

// Email / password, from your own sign-in screen
await FlockClient.Instance.Authentication.LoginWithEmailAsync(email, password);

// Device — guest sign-in with the device ID the SDK keeps for this install
await FlockClient.Instance.Authentication.LoginWithDeviceAsync();

// Platform identity — also LoginWithAppleAsync, LoginWithSteamAsync,
// LoginWithFacebookAsync, LoginWithDiscordAsync
await FlockClient.Instance.Authentication.LoginWithGoogleAsync(idToken);

For the platform methods the SDK exchanges a credential your platform SDK already produced; it does not obtain one for you. Google wants an ID token, Apple an identity token, Steam a session ticket, Facebook and Discord an access token. Facebook and Discord are login-only: they have no RegisterWith…Async, so the player’s account must already exist with that account linked to it (account linking).Sign in once. A sign-in is saved on the device and restored as the SDK starts, so check first whether a player is signed in already (FlockClient.Instance.IsAuthenticated, once FlockClient.IsRestoringSession is false) and sign in only when nobody is.Registering is a separate call. Logging in never creates an account, so a new player needs RegisterWith…Async first. A successful register also signs the player in, so no login call follows on the happy path.Registering an identity that already has an account is not an error — the call returns null and leaves the player signed out, so follow that case with a login. A device sign-in with no account screen logs in first, and registers only when the device has no account yet:

using Flock;
using Flock.Exceptions;

try
{
    await FlockClient.Instance.Authentication.LoginWithDeviceAsync();
}
catch (FlockException notRegistered) when (notRegistered.ErrorCode == FlockErrorCode.PlayerInvalidLoginCredentials)
{
    // The first launch on this device: registering creates the player and signs them in.
    await FlockClient.Instance.Authentication.RegisterWithDeviceAsync();
}

Afterward, read FlockClient.Instance.CurrentPlayerId. To react wherever the sign-in came from (a login, a register, or a sign-in restored at startup), handle FlockEvents.OnAuthenticated: its handler takes a FlockAuthInfo (PlayerId, and Method, a FlockAuthMethod). Handle OnAuthExpired to sign the player in again when a saved sign-in can no longer be renewed:

using Flock;
using UnityEngine;

public class SignInScreen : MonoBehaviour
{
    private void OnEnable()
    {
        FlockEvents.OnAuthenticated += OnSignedIn;
        FlockEvents.OnAuthExpired += OnSignInExpired;
    }

    private void OnDisable()
    {
        FlockEvents.OnAuthenticated -= OnSignedIn;
        FlockEvents.OnAuthExpired -= OnSignInExpired;
    }

    private void OnSignedIn(FlockAuthInfo info)
    {
        Debug.Log($"Signed in as {info.PlayerId} ({info.Method})");
    }

    private void OnSignInExpired()
    {
        Debug.Log("The saved sign-in expired: show the sign-in screen.");
    }
}

Picking a display name? Check it’s free first — advisory, since another player can still claim it in between:

using Flock;

bool available = await FlockClient.Instance.Authentication.IsNameAvailableAsync("PlayerName");

Every method is an async node under Flock | Auth, or a call on the auth provider in C++. Nothing throws — Unreal builds with exceptions off — so check Result.bSuccess, or wire the node’s On Failure pin.

#include "FlockSubsystem.h"
#include "Providers/FlockAuthProvider.h"

UFlockSubsystem* Sdk = UFlockSubsystem::Get(this);
if (Sdk->IsAuthenticated())
{
    return;   // Signed in already: Flock restored the saved sign-in as it started.
}
FFlockAuthProvider* Auth = Sdk->GetAuthProvider();

// One handler serves every login method. Call one of the methods below, for the way this player
// signs in: each sign-in ends the one before it.
auto OnLogin = [](TFlockResult<FFlockPlayerLoginResponse> Result)
{
    if (!Result.bSuccess)
    {
        UE_LOG(LogTemp, Warning, TEXT("%s"), *Result.Error.ToDisplayText());
    }
};

// Email / password, from your own sign-in screen
Auth->LoginWithEmail(Email, Password, OnLogin);

// Device — guest sign-in with the device ID the SDK keeps for this install (an empty ID)
Auth->LoginWithDevice(FString(), OnLogin);

// Platform identity — also LoginWithApple, LoginWithSteam,
// LoginWithFacebook, LoginWithDiscord
Auth->LoginWithGoogle(IdToken, OnLogin);

For the platform methods the SDK exchanges a credential your platform SDK already produced; it does not obtain one for you. Google wants an ID token, Apple an identity token, Steam a session ticket. Facebook and Discord are login-only — an account must already exist.For a device sign-in, leave the device ID empty: the device calls (LoginWithDevice, RegisterWithDevice, LinkDevice and their nodes) then use the SDK’s own, a GUID it makes the first time it is needed and keeps in Saved/Flock/device_id.txt. Read it with ThisDeviceId() on the auth provider, or Flock Get This Device Id in Blueprint. Any other ID is sent exactly as you pass it. A game that already signs players in with a device ID of its own (a GUID kept in a save game or a file) must keep passing that same ID, or those players get a new, empty account. Your first call says when the kept ID changes and when to pass your own.Sign in once. A sign-in is saved on the device and restored as the SDK starts, so check first whether a player is signed in already (IsAuthenticated(), or a Branch on Flock Is Authenticated in Blueprint) and sign in only when nobody is. A second sign-in ends the analytics session the first one started.Registering is a separate call. Logging in never creates an account, so a new player needs RegisterWith… first. A register that creates the account also signs the player in and raises OnAuthenticated, so no login follows.Registering an identity that already has an account is reported as a success with bAlreadyRegistered set, and signs nobody in: follow it with the login. Never log in after a register that signed the player in.

A Sign In With This Device custom event, with no inputs and both Device Id pins left empty so the SDK's kept id is used, branches on Flock Is Authenticated: True prints Already signed in; False runs Flock Register With Device, whose On Success breaks the result and branches on Already Registered: True runs Flock Login With Device, which prints Signed in, and False prints Registered and signed in; each On Failure prints the error through To String (Flock Error) — Sign in once: when nobody is signed in, register the device; when it already has an account, log in with the same ID.

The picture hands the nodes the event’s Device Id input; call the event with it empty to use this install’s ID.

void AMyActor::SignInWithThisDevice()
{
    UFlockSubsystem* Sdk = UFlockSubsystem::Get(this);
    if (!Sdk || !Sdk->IsInitialized() || Sdk->IsAuthenticated())
    {
        return;   // Not started, or a player is signed in already: a second sign-in ends the first one's session.
    }

    const TWeakObjectPtr<UFlockSubsystem> WeakSdk(Sdk);

    // An empty device ID: this install's own (ThisDeviceId). No display name either.
    Sdk->GetAuthProvider()->RegisterWithDevice(FString(), FString(),
        [WeakSdk](TFlockResult<FFlockRegisterResult> Registered)
        {
            UFlockSubsystem* LiveSdk = WeakSdk.Get();
            FFlockAuthProvider* Auth = LiveSdk ? LiveSdk->GetAuthProvider() : nullptr;
            if (!Auth)
            {
                return;   // The game is closing.
            }
            if (!Registered.bSuccess)
            {
                UE_LOG(LogTemp, Warning, TEXT("%s"), *Registered.Error.ToDisplayText());
                return;
            }
            if (!Registered.Value.bAlreadyRegistered)
            {
                return;   // A new player, signed in by the register.
            }
            Auth->LoginWithDevice(FString(), [](TFlockResult<FFlockPlayerLoginResponse> Login)
            {
                if (!Login.bSuccess)
                {
                    UE_LOG(LogTemp, Warning, TEXT("%s"), *Login.Error.ToDisplayText());
                }
            });
        });
}

Afterward, read Flock Get Player Id / GetPlayerId(). To react wherever the sign-in came from (a login, a register, or a sign-in restored at startup), bind OnAuthenticated; bind OnAuthExpired to sign the player in again when a saved sign-in can no longer be renewed. Both are on the event hub, and their C++ handlers must be UFUNCTION()s:

#include "FlockEvents.h"

// In BeginPlay; HandleSignedIn(const FFlockAuthInfo& Info) and HandleSignInExpired() are UFUNCTION()s of AMyActor.
if (UFlockSubsystem* Sdk = UFlockSubsystem::Get(this))
{
    Sdk->GetEvents()->OnAuthenticated.AddDynamic(this, &AMyActor::HandleSignedIn);
    Sdk->GetEvents()->OnAuthExpired.AddDynamic(this, &AMyActor::HandleSignInExpired);
}

Picking a display name? Check it’s free first — advisory, since another player can still claim it in between:

UFlockSubsystem::Get(this)->GetAuthProvider()->IsNameAvailable(TEXT("PlayerName"),
    [](TFlockResult<FFlockNameAvailableResponse> Result)
    {
        if (Result.bSuccess && !Result.Value.Available)
        {
            UE_LOG(LogTemp, Log, TEXT("%s is taken"), *Result.Value.Name);
        }
    });

Password reset

For email/password accounts, a two-step emailed-code flow. The first call always succeeds — it never reveals whether an email is registered. Resetting works signed out: the email and the emailed code name the account, so a player who cannot sign in can still reset their password from your sign-in screen.

Unity
Unreal

This runs inside an async method; email, code and newPassword come from your own screens.

using Flock;

// 1. Player enters their email; Flock emails them a reset code
await FlockClient.Instance.Authentication.ForgotPasswordAsync(email);

// 2. Player enters the code and their new password
await FlockClient.Instance.Authentication.ResetPasswordAsync(email, code, newPassword);

// Email, Code and NewPassword come from your own screens.
FFlockAuthProvider* Auth = UFlockSubsystem::Get(this)->GetAuthProvider();

// 1. The player enters their email; Flock emails them a reset code
Auth->ForgotPassword(Email, [](TFlockResult<FFlockAuthActionResponse> Sent) {});

// 2. The player enters the code and their new password
Auth->ResetPassword(Email, Code, NewPassword, [](TFlockResult<FFlockAuthActionResponse> Reset)
{
    if (!Reset.bSuccess)
    {
        UE_LOG(LogTemp, Warning, TEXT("%s"), *Reset.Error.ToDisplayText());
    }
});

Email verification

Optional, code-based, and always under your control — the SDK never sends verification emails on its own. Typically used while the player is signed in (their session is attached automatically), but neither call blocks on it.

Unity
Unreal

This runs inside an async method; code is the code the player typed from the email.

using Flock;

await FlockClient.Instance.Authentication.SendEmailVerificationAsync();

// Player enters the emailed code
await FlockClient.Instance.Authentication.VerifyEmailAsync(code);

FFlockAuthProvider* Auth = UFlockSubsystem::Get(this)->GetAuthProvider();

Auth->SendEmailVerification([](TFlockResult<FFlockAuthActionResponse> Sent) {});

// The player enters the emailed code
Auth->VerifyEmail(Code, [](TFlockResult<FFlockAuthActionResponse> Verified)
{
    if (!Verified.bSuccess)
    {
        UE_LOG(LogTemp, Warning, TEXT("%s"), *Verified.Error.ToDisplayText());
    }
});

Signing out

Logout clears the session on the device — the standard client sign-out. For shared devices or a compromised session, revoking additionally kills the player’s session server-side, so a stolen session token stops working. Shutting the SDK down is not a sign-out: the sign-in saved on the device stays, and the next start restores the same player.

Unity
Unreal

This runs inside an async method.

using Flock;

// Routine sign-out
FlockClient.Instance.Authentication.Logout();

// Hardened sign-out: revoke on the server, then clear locally
await FlockClient.Instance.Authentication.RevokeTokenAsync();
FlockClient.Instance.Authentication.Logout();

// Routine sign-out
UFlockSubsystem::Get(this)->GetAuthProvider()->Logout();

// Hardened sign-out: revoke on the server, then clear locally
UFlockSubsystem* Sdk = UFlockSubsystem::Get(this);
const TWeakObjectPtr<UFlockSubsystem> WeakSdk(Sdk);
Sdk->GetAuthProvider()->RevokeToken([WeakSdk](TFlockResult<FFlockTokenRevokeResponse>)
{
    UFlockSubsystem* LiveSdk = WeakSdk.Get();
    if (FFlockAuthProvider* Auth = LiveSdk ? LiveSdk->GetAuthProvider() : nullptr)
    {
        Auth->Logout();
    }
});

Sessions are managed for you

Player sessions are short-lived under the hood, but the SDK refreshes them automatically — you don’t have to think about tokens or expiry. If a player needs to sign back in, the SDK raises OnAuthExpired on its event hub (in Unreal, bind it as shown under Sign in a player).

Getting Started

Concepts

Features

Reference

Authentication

Configure your game

Password reset

Email verification

Signing out

Sessions are managed for you

​Configure your game

​Sign in a player

​Password reset

​Email verification

​Signing out

​Sessions are managed for you

Configure your game

Sign in a player

Password reset

Email verification

Signing out

Sessions are managed for you