Sign players in without running your own auth server.

One player, one user ID, from the first match onwards

Follow a player from their first session to your game API. Each step links to the guide that covers it.

1. 01

   Start as a guest, with no form

   Players start playing straight away. Your game creates a guest session in one call. A guest is a real account with a stable user ID.

   playAsGuest.addEventListener("click", () => {
     void auth4
       .signInAsGuest()
       .then(showGuest)
       .catch((error: unknown) => {
         status.textContent =
           error instanceof Auth4BrowserError ? error.message : "Unable to start a guest session.";
       });
   });

   Guest accounts

2. 02

   Progress saves under one user ID

   The guest's user ID is the access token's sub. Store saves, unlocks and scores against it. A guest with nothing linked can be queued for deletion after 30 days without recorded activity, so invite players to save.

   Tokens and revocation

3. 03

   Upgrade and keep the same sub

   When a player wants to keep their progress, they link Steam, Discord or an email address. auth4.dev attaches it to the same user, so sub doesn't change. If that account already belongs to another player, the upgrade is refused and nothing is merged.

   function saveGuestProgress(provider?: SocialProvider): void {
     auth4.upgradeGuest(provider ? { provider } : {}).then(
       () => void showSignedIn().catch(() => showSignedOut()),
       (error: unknown) => {
         if (!(error instanceof Auth4BrowserError)) throw error;
         if (error.code === "identity_in_use") {
           status.textContent = "That account already exists. Sign in to it, or link another one.";
         } else if (error.code === "invalid_session") {
           showSignedOut("Your guest session ended. Play as a guest again or sign in.");
         } else if (error.code === "popup_blocked") {
           status.textContent = "Allow pop-ups for this page, then try again.";
         }
         // cancelled and window_closed leave the guest session unchanged.
       },
     );
   }

   Steam sign-inDiscord sign-inEmail sign-in

4. 04

   Carry on from a console or handheld

   With no keyboard or browser, the game shows a short code instead. The player checks it on their phone, signs in to the same account and approves. The game polls until its tokens arrive.

   Device sign-in

5. 05

   Your game API checks a short-lived token

   Your server verifies each access token against your project's issuer and audience. Tokens expire after five minutes, and guests carry a claim you can check. Load the player's data by sub.

   const claims = await authenticateRequest(request, client);
   if (!claims) return unauthorizedResponse();
   if (claims.isGuest) {
     // The token carries "auth4_guest": true. Ask the player to save their progress first.
     return Response.json({ error: "account_required" }, { status: 403 });
   }
   return Response.json({ subject: claims.sub });

   Server APIs