Skip to main content

Sign in with Google Play Games Services

POST 
/auth/google-play-games

Exchange a Google Play Games Services (GPGS) server auth code for a Zyphr end-user session. Unlike Game Center (which submits an Apple-signed assertion), GPGS is verified by Google: Zyphr exchanges the single-use server auth code at Google's OAuth2 token endpoint, then calls the Play Games REST API (players/me) server-side to obtain the trusted, tamper-proof playerId. The user is provisioned-or-looked-up on that server-fetched playerId and tokens are minted.

Producing the server auth code (Integration)​

The server auth code is obtained on-device by the Android app — there is no server-side way to mint it. The app calls GamesSignInClient.requestServerSideAccess(serverClientId, …) using the Google Cloud web (server) client id configured for the game, which returns a single-use auth code string. Submit that string here as serverAuthCode.

The backend-relayed shape is the common one: the app forwards the auth code to the customer's own backend, which relays it to this endpoint; the app never holds Zyphr keys.

Security​

The playerId is derived only from Zyphr's own server-side call to Google after the token exchange — a client-supplied player id is never accepted or trusted. On any verification failure the response is a single opaque 401 invalid_auth_code; the specific control that failed is never disclosed.

Request​

Responses​

Auth code verified; returning player (existing identity), fresh tokens issued