---
title: "Authenticate Player"
method: POST
path: "/{YOUR_AUTHENTICATE_PLAYER_ENDPOINT}"
tags: ["Authentication"]
---

# Authenticate Player

`POST /{YOUR_AUTHENTICATE_PLAYER_ENDPOINT}`

<Note> This is a callback API. Appcharge calls this endpoint on your server when specific events occur. </Note> 

 Notifies your system to authenticate a player in your web store. <br /> <br /> Appcharge calls this endpoint when a player attempts to log in to your web store using one of the configured login methods. Your server identifies the player and responds with either the player data or an authentication error. <br /> <br /> If the response indicates a successful authentication, the player is logged in to the web store.

## Headers

- `x-publisher-token` string
- `signature` string

## Request body

- object
  - `authMethod` 'facebook' | 'apple' | 'google' | 'userToken' | 'userPassword' | 'otp' — Authentication method the player used. **Note:** If the player logged in using either Pre-Authenticated Login or Game Redirect Login, Appcharge sends the value `otp`.
  - `token` string, nullable — Authentication token. Used for SSO Login and Player ID Login.
  - `date` string, date-time — UTC time when the player tried to log in.
  - `appId` string — App ID in the Publisher Dashboard. Used for the SSO Login method. If no app ID is available, Appcharge sends `"NA"`.
  - `userName` string, nullable — Username the player entered when logging in to the web store.
  - `password` string, nullable — Password the player entered when logging in to the web store.
  - `otp` object, nullable — Additional authentication tokens provided by your game. **Note:** This field is sent only if the player logged in using Pre-Authenticated Login or Game Redirect Login.
    - `playerCode` string — The 4 or 6 digit code used for verifying the player.
    - `accessToken` string — Player access token.
  - `os` 'ios' | 'android' | 'web' — Operating system the player used to log in.
  - `utmSource` string — Source of the traffic. This is where the player came from before reaching the store.
  - `utmMedium` string — Marketing channel used to bring in the traffic.
  - `utmCampaign` string — Marketing campaign identifier associated with the traffic.
  - `sessionId` string — Session ID.
  - `playerLocation` object — Location of the player.
    - `countryCode2` string — Two-letter country code in [ISO-3166 alpha-2](https://en.wikipedia.org/wiki/ISO_3166-1_alpha-2) format. Required if `playerIp` is not provided. Example: `US`.
    - `playerIp` string — Player IP address in [IPv4](https://en.wikipedia.org/wiki/IPv4) format. Required if `countryCode2` is not provided. Example: `192.0.2.1`.
    - `state` string — Two-letter state code. Example: `NY`

## Response `200`

- object
  - `status` 'valid', required — The status of the player authentication. If you pass a value other than `valid`, the API fails.
  - `playerProfileImage` string — Player profile image. If no image is available, an empty string must be provided. In this case, a default image is displayed.
  - `publisherPlayerId` string, required — Player ID.
  - `playerName` string, required — Player name.
  - `sessionMetadata` object — An object for passing data related to the player's session. It is returned in the [Grant Award Callback](/../../api-reference/checkout/awards/grant-award-callback), and if enabled, the [Personalization API](/../../api-reference/webstore/personalization/introduction).
  - `publisherErrorMessageType` 'none' | 'plainText' | 'enrichedText' — Error message type. Supported values: + `none`: No error message is provided. + `plainText`: A basic error message in plain text. + `enrichedText`: A formatted error message in MD format that may contain additional styling or elements.
  - `publisherErrorMessage` string — Error message.
  - `publisherErrorMessageTitle` string — Error message title displayed to players when a login attempt fails.
  - `playerOverrideCountry` string — Overrides the player's detected location for pricing purposes. Use when the player's country of origin differs from their detected country. Must be a two-letter country code in [ISO-3166 alpha-2](https://en.wikipedia.org/wiki/ISO_3166-1_alpha-2) format.

---

[API](https://skmtc.net/appcharge/apis/grant-award.md) · [All operations](https://skmtc.net/appcharge/apis/grant-award/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/appcharge/grant-award/revisions/b4f6759240d5/schema)