Linked accounts

A player who signed up with email can link Steam, Discord or Epic Games and then sign in with any of them to the same account. The user ID never changes, and accounts are never merged.

How it works

Your game asks auth4.dev to link (or unlink) one provider for the signed-in player. The SDK opens the hosted Linked accounts page, which shows the player's current sign-in methods. To link, the player signs in with the provider there and confirms. To unlink, they only confirm. The SDK then swaps in a refreshed session for the same user.

The page never receives a token. Your game keeps a one-time poll secret in memory and collects the refreshed session with it, as it does when a player adds an email address.

Browser SDK

Call linkAccount() or unlinkAccount() from a click handler, so the browser allows the window.

linkSteamButton.addEventListener("click", async () => {
  try {
    await auth4.linkAccount("steam");
    status.textContent = "Steam is linked. You can sign in with it too.";
  } catch (error) {
    // "cancelled" and "window_closed" mean the player stopped; nothing changed.
    status.textContent = "Steam was not linked.";
  }
});

linkedAccounts() lists the player's sign-in methods (for exampleemail and steam), so you can show the right buttons.

Unity SDK

try
{
    await _client.LinkAccountAsync(LinkableProvider.Steam);
}
catch (Auth4LinkAccountException error) when (error.Reason == LinkAccountFailure.Denied)
{
    // The player chose Not now.
}

UnlinkAccountAsync works the same way. Both open the page with theBrowserLauncher.

Rules

Case	What happens
The provider account is new to your project	It is linked to the player. Signing in with it later returns the same user ID.
The provider account already belongs to another player	The page says the account is already in use and nothing changes. The player can try a different account.
The player already has an account of that provider linked	The request is refused with `provider_already_linked`. Unlink it first.
Unlinking the only way the player can sign in	Refused with `only_sign_in_method`. Add another sign-in method first.
The player is a guest	Refused with `guest_account`. Use the guest upgradeinstead.
The provider is turned off for the project	Linking is refused with `provider_disabled`. Unlinking still works.
The player signed in more than five minutes ago	Refused with `login_required`. Sign the player in again, then retry.
A link or unlink completes	The account's email address, if it has one, gets a notice. An unlink also signs the player out on every other device.

Each link and unlink is recorded as an identity.linked oridentity.unlinked audit event. The event names the provider and identity, never the Steam, Discord or Epic Games account ID.

Full request and error details: link intent reference.