Auth

FRVR.auth authenticates the current player against FRVR’s backend — either with a FRVR account, a platform provider (Facebook, Google Play, Apple, …), or anonymously.

Auth is the gatekeeper for cross‑device features: cloud storage, tournaments, social, leaderboards, and shop all run through it.

Minimal setup

FRVR.config.auth = {};   // let the current channel pick its provider

(No extra FRVR.init() call — you’ve already called it once during startup.)

The SDK auto‑logs in from:

A cached token in storage (if still valid), or
The channel’s native credentials (e.g. Facebook Instant session), or
Anonymous sign‑in, if enabled.

FRVR.config.auth = { enableAnonymousLogin: true };

Reading the current session

if (FRVR.auth.isLoggedIn()) {
  const token  = FRVR.auth.getAccessToken();  // JWT, or null if expired
  const frvrId = FRVR.auth.getFRVRID();       // FRVR user id
}

Tokens refresh themselves in the background around 60% of their TTL — you can treat getAccessToken() as always returning a fresh one when logged in.

On the web, on frvr.com, and in FRVR’s native apps, the host has its own sign‑in screen. One call opens it:

const loggedIn = await FRVR.auth.requestLogin({ reason: 'user' });

It resolves true once the player is signed in to an FRVR account, and false if they dismissed the screen or the channel has no login UI. A player who already has a verified FRVR account gets true straight away.

Option	Purpose
`reason`	Why the login is requested: `'user'`, `'purchase'`, or `'titlebar'`. The host may word its screen to match.
`method`	Open on a specific method: `'code'`, `'password'`, or `'oauth'`.
`provider`	With `method: 'oauth'`, go straight to that provider: `'google'`, `'apple'`, `'samsung'`.
`email`	Prefill the email field.

To decide what to show, ask what the channel supports:

const caps = await FRVR.auth.getLoginCapabilities();
// { hostLoginUI: true, methods: ['code', 'password', 'oauth'], providers: ['google', 'apple'] }

if (caps.hostLoginUI) loginButton.onclick = () => FRVR.auth.requestLogin({ reason: 'user' });
if (caps.providers.includes('apple')) showAppleButton();

Without a host login UI, methods lists what the game can drive in‑page (code and password, where the channel allows FRVR login) and providers is empty.

A passwordless flow for games that draw their own login form. The player gets a one‑time code by email:

const flow = await FRVR.auth.requestEmailLoginCode('user@example.com');

await flow.continue(codeTypedByPlayer);   // logs the player in
await flow.resend();                      // sends a new code for the same flow

requestEmailRegisterCode(email) works the same way and creates the account.

Only needed if you draw your own form and the channel doesn’t sign the user in automatically (typically web):

await FRVR.auth.loginToFRVR({
  platform: 'frvr',
  credentials: {
    email: 'user@example.com',
    password: 'hunter2',
  },
});

Or by provider credentials the channel gave you:

await FRVR.auth.loginToFRVR({
  platform: 'facebook-instant',
  credentials: {
    asid: '…',
    appId: '…',
    asidSignedRequest: '…',
  },
});

'frvr' and the other platform strings come from the Platform enum (Platform.FRVR, Platform.FACEBOOK_INSTANT, …), exported from the SDK package — they’re not on window.FRVR, so use the string literals here.

Registration

await FRVR.auth.registerOnFRVR(
  { email, password, firstName, lastName },
  /* ifConflictTryLogin = */ true
);

With ifConflictTryLogin = true, an existing‑account error automatically degrades to a login attempt.

Anonymous

await FRVR.auth.loginAsAnonymous();

Anonymous sessions still persist a stable ID. You can upgrade one to a real account later with registerOnFRVR.

Logout

if (FRVR.auth.isLogoutSupported()) {
  await FRVR.auth.logout();
}

Some channels don’t allow logout (the player is always signed in via the host app) — check first.

Reacting to status changes

FRVR.auth.addStatusChangeListener((isLoggedIn) => {
  if (isLoggedIn) refreshPlayerUI(FRVR.auth.getFRVRID());
  else            showLoggedOutState();
});

The callback receives one boolean. It fires on login and logout, and also when the account changes while the player stays logged in (switching accounts, or an anonymous player signing in). In that case isLoggedIn is still true, so compare FRVR.auth.getFRVRID() with the last one you saw. A token renewal for the same account doesn’t fire it, and neither does a logout caused by an expired token.

API summary

Method	Purpose
`init()`	Auto‑login (called by `FRVR.init`).
`isLoggedIn()`	Valid session present?
`isLoggingIn()`	Login in progress?
`getAccessToken()`	JWT for backend calls.
`getFRVRID()`	Current user’s FRVR id.
`isVerified()`	Email verified (FRVR accounts only).
`getCurrentPlatform()`	Which provider signed in (`'FRVR'`, `'facebook'`, …).
`getAvailableLoginPlatforms()`	Other providers you could offer.
`getLoginCapabilities()`	Login methods and providers this channel offers.
`requestLogin(options?)`	Open the host’s login UI.
`requestEmailLoginCode(email)` / `requestEmailRegisterCode(email)`	Start an email code flow.
`isFRVRLoginEnabled()`	Channel allows FRVR credentials?
`loginToFRVR(req)`	Explicit login.
`loginAsAnonymous()`	Anonymous session.
`registerOnFRVR(creds, ifConflictTryLogin?)`	Create account and log in.
`logout()`	Clear session.
`isLogoutSupported()`	Channel allows logout?
`addStatusChangeListener(fn)`	Subscribe to session changes.