Unity Authentication API

openapi: 3.2.0
info:
  title: Unity Player Authentication API
  description: The Unity Player Authentication REST API verifies player identity and manages authentication workflows. It provides endpoints for anonymous sign-in, platform-specific authentication (Google, Apple, Steam, Facebook), custom identity provider integration, token refresh, and account linking. Supports both the player-facing authentication flow and admin operations for player management.
  version: v1.0.0
  termsOfService: https://unity.com/legal/terms-of-service
  contact:
    name: Unity Support
    url: https://support.unity.com
  license:
    name: Unity Terms of Service
    url: https://unity.com/legal/terms-of-service
servers:
- url: https://player-auth.services.api.unity.com
  description: Unity Player Authentication Production Server
security:
- bearerAuth: []
tags:
- name: Authentication
  description: Player sign-in and token management
paths:
  /v1/authentication/anonymous:
    post:
      operationId: signInAnonymously
      summary: Sign In Anonymously
      description: Signs in a player anonymously and returns an access token. Creates a new player account if the session ID does not match any existing player.
      tags:
      - Authentication
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/AnonymousSignInRequest'
      responses:
        '200':
          description: Authentication successful
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AuthResponse'
        '400':
          description: Bad Request
        '401':
          description: Unauthorized
  /v1/authentication/usernamepassword/sign-in:
    post:
      operationId: signInWithUsernamePassword
      summary: Sign In With Username and Password
      description: Authenticates a player using their username and password credentials.
      tags:
      - Authentication
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/UsernamePasswordSignInRequest'
      responses:
        '200':
          description: Authentication successful
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AuthResponse'
        '400':
          description: Bad Request
        '401':
          description: Invalid credentials
  /v1/authentication/usernamepassword/sign-up:
    post:
      operationId: signUpWithUsernamePassword
      summary: Sign Up With Username and Password
      description: Creates a new player account with username and password credentials.
      tags:
      - Authentication
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/UsernamePasswordSignUpRequest'
      responses:
        '200':
          description: Account created and signed in
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AuthResponse'
        '400':
          description: Bad Request - invalid or duplicate username
  /v1/authentication/external-token:
    post:
      operationId: signInWithExternalToken
      summary: Sign In With External Token
      description: Authenticates a player using a token from an external identity provider such as Google, Apple, Steam, Facebook, or a custom provider.
      tags:
      - Authentication
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ExternalTokenSignInRequest'
      responses:
        '200':
          description: Authentication successful
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AuthResponse'
        '400':
          description: Bad Request
        '401':
          description: Invalid external token
  /v1/token/refresh:
    post:
      operationId: refreshToken
      summary: Refresh Authentication Token
      description: Exchanges a refresh token for a new access token without requiring the player to re-authenticate.
      tags:
      - Authentication
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/RefreshTokenRequest'
      responses:
        '200':
          description: New access token issued
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AuthResponse'
        '401':
          description: Invalid or expired refresh token
components:
  schemas:
    RefreshTokenRequest:
      type: object
      required:
      - refreshToken
      properties:
        refreshToken:
          type: string
    AnonymousSignInRequest:
      type: object
      required:
      - sessionTokens
      properties:
        sessionTokens:
          type: array
          items:
            type: string
          description: List of session tokens for anonymous sign-in continuity
    ExternalTokenSignInRequest:
      type: object
      required:
      - idProvider
      - token
      properties:
        idProvider:
          type: string
          enum:
          - google
          - apple
          - steam
          - facebook
          - custom
          description: The external identity provider
        token:
          type: string
          description: The identity token from the external provider
        signInOnly:
          type: boolean
          description: If true, only sign in and do not create a new account
    UsernamePasswordSignUpRequest:
      type: object
      required:
      - username
      - password
      properties:
        username:
          type: string
          minLength: 3
          maxLength: 20
        password:
          type: string
          minLength: 8
    AuthResponse:
      type: object
      properties:
        idToken:
          type: string
          description: JWT access token
        sessionToken:
          type: string
        expiresIn:
          type: integer
          description: Token expiry in seconds
        userId:
          type: string
        isNew:
          type: boolean
          description: True if a new account was created
    UsernamePasswordSignInRequest:
      type: object
      required:
      - username
      - password
      properties:
        username:
          type: string
        password:
          type: string
  securitySchemes:
    bearerAuth:
      type: http
      scheme: bearer
      bearerFormat: JWT
    serviceAccountAuth:
      type: http
      scheme: basic
externalDocs:
  description: Unity Player Authentication Documentation
  url: https://docs.unity.com/ugs/en-us/manual/authentication/manual/rest-api