menu_bookDocumentation
Auth Tokens - s&box Services Documentation
Auth Tokens
Auth tokens allow your game to authenticate players with external backends. The token proves the player's identity and can be validated against Facepunch's auth service.
Generating Tokens
Get an auth token for the local player:
CSHARP
var token = await Sandbox.Services.Auth.GetToken();
// Send to your backend
await myBackend.Authenticate( token );Tokens are short-lived and should be generated fresh for each authentication.
Validating Tokens
On your backend, validate tokens by calling Facepunch's auth service:
CSHARP
private class ValidateAuthTokenResponse
{
public long SteamId { get; set; }
public string Status { get; set; }
}
public static async Task<bool> ValidateToken( long steamId, string token )
{
var http = new System.Net.Http.HttpClient();
var data = new Dictionary<string, object>
{
{ "steamid", steamId },
{ "token", token }
};
var content = new StringContent(
JsonSerializer.Serialize( data ),
Encoding.UTF8,
"application/json"
);
var result = await http.PostAsync(
"https://services.facepunch.com/sbox/auth/token",
content
);
if ( result.StatusCode != HttpStatusCode.OK ) return false;
var response = await result.Content.ReadFromJsonAsync<ValidateAuthTokenResponse>();
if ( response is null || response.Status != "ok" ) return false;
return response.SteamId == steamId;
}Usage
Validate the token when receiving it from clients:
CSHARP
var isValidToken = await ValidateToken( steamId, token );
if ( isValidToken )
{
// Authenticated successfully
}Security
- Tokens expire quickly - use them immediately
- Always validate on your backend, never trust client
- Use HTTPS for all auth communications
Was this helpful?