Authentication

How it works

1. The browser SDK mounts a small pill in the top-right corner of your page. Before login it reads Log in; after, it shows the player's avatar and name. Pass login: false to leave it out and drive login from your own button instead.
2. Clicking it opens a popup on indie.fun, email/password, or Sign in with Discord. Your page never sees a password.
3. On success the popup hands your page a signed JWT. The SDK stores it, tells indie.fun a player joined, and attaches the account to the session already being measured.
4. Your game server (if you run one) receives a playerJoin event over a WebSocket, with the player's saved data and permissions already loaded.

Set it up

Login needs nothing beyond the App ID. Creating the client is the whole setup:

<script src="https://indie.fun/js/indie.js"></script>
<script>
  const indie = new Indie({ appId: 'your-app-id' });
</script>

Read the signed-in player, and react to changes:

indie.getUser();        // { id, name, picture } | null
indie.getToken();       // the JWT, or null
indie.getPermissions(); // { chat: true, vip: false }

// Fires immediately with the current state, then on every login/logout
indie.onChange(({ user, token, permissions }) => {
  if (!user) return showLoginPrompt();
  startGameAs(user.name);
});

Use your own login button

login: false leaves the pill unmounted, and indie.login() opens the same popup from a button of your own:

const indie = new Indie({ appId: 'your-app-id', login: false });

myButton.onclick = () => indie.login();   // open the popup yourself
indie.onChange(({ user }) => { ... });    // the result arrives here

Call it from a real click. A popup opened outside a user gesture is blocked by the browser.

The flag hides the SDK's own UI and nothing else. A token already stored is still restored, and sessions, session length, frame rate, progression and crash reporting all run exactly as before, none of them needs a signed-in player. The guest analytics notice is not part of login either and still appears.

Verify a player on your server

With the server SDK (needs your App Secret, never the browser):

const { Indie } = require('indie-sdk/server');
const indie = new Indie({
  appId: 'your-app-id',
  appSecret: process.env.INDIE_APP_SECRET,
});

const player = await indie.verifyToken(tokenFromBrowser);
if (!player) return reject('not signed in');
player.userId; // trust this one

Or straight over HTTP:

curl -X POST https://indie.fun/api/auth/verify-token \
  -H 'Content-Type: application/json' \
  -H 'X-App-Id: your-app-id' \
  -H 'X-App-Secret: your-app-secret' \
  -d '{"token":"<player token>"}'

# { "valid": true, "userId": "...", "name": "...", "email": "...",
#   "discordId": "...", "solanaWallet": null }

An invalid or expired token answers 401. The response also carries the player's verified Solana wallet when they have linked one. See Tokens.

Permissions

A permission is a name your game checks (chat, vip) mapped to a Discord role. Configure them under Permissions on your game's page: pick your Discord server, add the Indie bot so we can read roles, then map each role to a permission name.

In the browser

indie.getPermissions() returns a flat map, e.g. { chat: true, vip: false }, and updates through onChange.

On your server

player.permissions on the playerJoin event carries the same map.

When a player lacks a role

The widget tells them which role they need and links your Discord invite, so you don't have to build that UI. With login: false there is no widget, so that message is yours to show; getPermissions() is what to show it from.

Check it worked

await fetch('https://indie.fun/api/sdk/verify', {
  method: 'POST',
  headers: {
    'Content-Type': 'application/json',
    Authorization: 'Bearer ' + indie.getToken(),
  },
  body: JSON.stringify({ appId: indie.getAppId(), sessionId: indie.getSessionId() }),
}).then(r => r.json());

// auth: { valid: true, userId: '...' }   ← the token is one we issued
// session: { identity: 'account' }       ← the session is attributed to it

When it doesn't work

The popup opens and closes, nothing happens

The SDK only accepts the token from indie.fun itself. A custom apiUrl that isn't the host you actually log in on will silently drop it. Leave apiUrl unset unless you know you need it.

The popup never opens

A popup blocker. The widget opens it from a real click, so this usually means the click was intercepted by your own handler. Check for stopPropagation on the page. Calling indie.login() yourself has the same rule: it has to run in the click, not after an await or a timer, or the browser treats it as unrequested and blocks it.

Permissions are all false

The player has no Discord linked, isn't in your server, or the Indie bot isn't in it. The widget states which of the three it is.

Login works, but my server never hears about it

playerJoin arrives over a WebSocket authenticated with your App Secret. A wrong secret closes the socket with code 4003 and logs invalid appId or appSecret.