Authentication

Flock authentication has two layers, and the SDK handles both:

Game — the SDK authenticates your game with the credentials you configure once (API Key, Game ID, Game Version). Every request it makes is then identified as your game.
Player — players sign in through the SDK, which then manages their session automatically for the rest of play.

Configure your game

Set your credentials in your engine’s settings. The editor also verifies the connection and resolves your Game Version, both required before the SDK can start.

Unity
Unreal

Credentials live in Flock → Settings — see Unity setup.With Auto-Initialize On Load the SDK authenticates as your game at startup; turn it off to initialize it yourself. Reach everything through FlockClient.Instance.

Credentials live in Project Settings → Plugins → Flock SDK — see Unreal setup.With Auto-Initialize On Load the SDK authenticates as your game at startup; turn it off to initialize it yourself. Reach everything through UFlockSubsystem::Get(this).

Players sign in with one of several methods. Each resolves to the same player account, and the SDK keeps them signed in afterward.

Unity
Unreal

Every method is a LoginWith…Async call on FlockClient.Instance.Authentication. They throw FlockException on failure, so wrap them in try/catch to give bad credentials or a dead network a clean retry path.

// Email / password
await FlockClient.Instance.Authentication.LoginWithEmailAsync(email, password);

// Device ID — frictionless guest sign-in keyed to the device
await FlockClient.Instance.Authentication.LoginWithDeviceAsync(deviceId);

// Platform identity — also LoginWithAppleAsync, LoginWithSteamAsync,
// LoginWithFacebookAsync, LoginWithDiscordAsync
await FlockClient.Instance.Authentication.LoginWithGoogleAsync(idToken);

For the platform methods the SDK exchanges a credential your platform SDK already produced; it does not obtain one for you. Google wants an ID token, Apple an identity token, Steam a session ticket.Registering is a separate call. Logging in never creates an account, so a new player needs RegisterWith…Async first. A successful register also signs the player in, so no login call follows on the happy path.Registering an identity that already has an account is not an error — the call returns null and leaves the player signed out, so follow that case with a login:

FlockAuthProvider auth = FlockClient.Instance.Authentication;

// null means "this identity already has an account" — created nothing, signed in nobody.
if (await auth.RegisterWithDeviceAsync(deviceId) == null)
    await auth.LoginWithDeviceAsync(deviceId);

Afterward, read FlockClient.Instance.CurrentPlayerId or handle FlockEvents.OnAuthenticated.Picking a display name? Check it’s free first — advisory, since another player can still claim it in between:

bool available = await FlockClient.Instance.Authentication.IsNameAvailableAsync("PlayerName");

Every method is an async node under Flock | Auth, or a call on the auth provider in C++. Nothing throws — Unreal builds with exceptions off — so check Result.bSuccess, or wire the node’s On Failure pin.

UFlockSubsystem* Sdk = UFlockSubsystem::Get(this);

// Email / password
Sdk->GetAuthProvider()->LoginWithEmail(Email, Password, OnLogin);

// Device ID — frictionless guest sign-in keyed to the device
Sdk->GetAuthProvider()->LoginWithDevice(DeviceId, OnLogin);

// Platform identity — also LoginWithApple, LoginWithSteam,
// LoginWithFacebook, LoginWithDiscord
Sdk->GetAuthProvider()->LoginWithGoogle(IdToken, OnLogin);

For the platform methods the SDK exchanges a credential your platform SDK already produced; it does not obtain one for you. Google wants an ID token, Apple an identity token, Steam a session ticket. Facebook and Discord are login-only — an account must already exist.Registering is a separate call. Logging in never creates an account, so a new player needs RegisterWith… first. Registering does not sign the player in, so follow it with a login.Registering an identity that already has an account is reported as a success with bAlreadyRegistered set, so you can route the player to a login rather than show them a failure.Afterward, read Flock Get Player Id / GetPlayerId(), or handle the OnAuthenticated event.Picking a display name? Check it’s free first — advisory, since another player can still claim it in between:

Sdk->GetAuthProvider()->IsNameAvailable(TEXT("PlayerName"), OnChecked);

Password reset

For email/password accounts, a two-step emailed-code flow. The first call always succeeds — it never reveals whether an email is registered. Resetting requires the current session to have been signed in with email — a device or Steam session cannot reset a password it never had.

Unity
Unreal

// 1. Player enters their email; Flock emails them a reset code
await FlockClient.Instance.Authentication.ForgotPasswordAsync(email);

// 2. Player enters the code and their new password
await FlockClient.Instance.Authentication.ResetPasswordAsync(email, code, newPassword);

Sdk->GetAuthProvider()->ForgotPassword(Email, OnSent);
Sdk->GetAuthProvider()->ResetPassword(Email, Code, NewPassword, OnReset);

Email verification

Optional, code-based, and always under your control — the SDK never sends verification emails on its own. Typically used while the player is signed in (their session is attached automatically), but neither call blocks on it.

Unity
Unreal

await FlockClient.Instance.Authentication.SendEmailVerificationAsync();

// Player enters the emailed code
await FlockClient.Instance.Authentication.VerifyEmailAsync(code);

Sdk->GetAuthProvider()->SendEmailVerification(OnSent);
Sdk->GetAuthProvider()->VerifyEmail(Code, OnVerified);

Signing out

Logout clears the session on the device — the standard client sign-out. For shared devices or a compromised session, revoking additionally kills the player’s session server-side, so a stolen session token stops working.

Unity
Unreal

// Routine sign-out
FlockClient.Instance.Authentication.Logout();

// Hardened sign-out: revoke on the server, then clear locally
await FlockClient.Instance.Authentication.RevokeTokenAsync();
FlockClient.Instance.Authentication.Logout();

// Routine sign-out
Sdk->GetAuthProvider()->Logout();

// Hardened sign-out: revoke on the server, then clear locally
Sdk->GetAuthProvider()->RevokeToken([Sdk](TFlockResult<FFlockTokenRevokeResponse>)
{
    Sdk->GetAuthProvider()->Logout();
});

Sessions are managed for you

Player sessions are short-lived under the hood, but the SDK refreshes them automatically — you don’t have to think about tokens or expiry. If a player needs to sign back in, the SDK raises OnAuthExpired on its event hub.

Getting Started

Concepts

SDKs

Features

Reference

Authentication

Configure your game

Password reset

Email verification

Signing out

Sessions are managed for you

​Configure your game

​Sign in a player

​Password reset

​Email verification

​Signing out

​Sessions are managed for you

Configure your game

Sign in a player

Password reset

Email verification

Signing out

Sessions are managed for you