Linqgg Authentication

generated: '2026-07-19'
method: searched
source: https://docs.linq.gg/modules/auth/tokens
docs: https://docs.linq.gg/modules/auth
description: >-
  LinQ does not use OAuth 2.0 or OpenID Connect. Access is granted by opaque
  bearer tokens minted by the LinQ auth services, seeded by a per-game secret
  key issued out of band at integration time. There are two access tokens and
  two auxiliary secrets.
transport:
  protocol: grpc
  header: authorization
  format: 'Bearer <token>'
  example_metadata: '{ meta: { authorization: `Bearer ${accessToken}` } }'
  tls_required: true
schemes:
- id: access_token
  kind: bearer
  name: Access Token
  issued_by: AuthGameService.SignInGame
  description: >-
    Minted for a game user from the game's private secret key plus the game's
    internal user id. Signs user transactions in conditional-anonymity mode.
  lifetime: unlimited
  storage: persist on the user profile in the game backend
  grants: anonymous-mode operations — balances, deposits, entry fees, tournament rewards
  restrictions:
  - cannot transfer funds to the wallet account or other games
  - subject to a maximum stored-funds limit (anonymous total deposit limit 20.00)
- id: wallet_token
  kind: bearer
  name: Wallet Token
  issued_by: AuthUserService.SignInGameUser
  description: >-
    Issued after the user authorizes through the LinQ app and links their game
    account to a real wallet account. Same header shape as Access Token, wider
    rights.
  lifetime: unlimited
  storage: persist on the user profile; prefer over Access Token when both are held
  recommended_pattern: 'getAuthorization(user.walletToken ?? user.accessToken)'
  grants: all operations including KYC, wallet transfer, withdrawal to bank or card
- id: private_secret_key
  kind: apiKey
  name: Private Secret Key
  usage: >-
    Server-to-server. Passed as the game_token field of SignInGameRequest to
    verify requests coming from the game backend and obtain a user Access Token.
  issued: before integration begins, out of band
  handling: >-
    Supply as an environment variable; docs recommend Google Secret Manager or
    equivalent. Must never be shipped in client code.
- id: public_secret_key
  kind: apiKey
  name: Public Secret Key / Mobile SDK Secret Key
  usage: >-
    Initializes the LinQ Unity SDK and verifies requests originating from the
    front end. Set via LinqSDK.InitSDK(remoteUrl, secretKey) or the
    LinqSettings.asset editor config.
  issued: before integration begins, out of band
- id: secret_token
  kind: temporary
  name: Secret / User Token
  issued_by: AuthUserService.SignUpGameUser
  description: >-
    Short-lived token handed to the LinQ app (via deep link or Keychain) to
    initiate account linking. Exchanged by SignInGameUser for a Wallet Token.
  lifetime: single use, for the linking handshake only
linking_flows:
- id: deep_link
  description: >-
    Game embeds the user_token in a LinQ deep link. Falls back to the App Store
    when the app is not installed.
  schemes:
    stage: 'linq-stg://?user_token={token}'
    production: 'linq://?user_token={token}'
  associated_domains:
    stage: 'https://a.stg.linq.gg?user_token={token}'
    production: 'https://a.linq.gg?user_token={token}'
- id: keychain
  description: >-
    Apple-only fallback used when the LinQ app is not yet installed. The game
    writes the token to a shared Keychain access group; the LinQ app reads it
    after install and authorizes the game.
  access_groups:
    stage: $(AppIdentifierPrefix)games.galactica.linq.stg.shared
    production: $(AppIdentifierPrefix)games.galactica.linq.shared
  api: LinqUnity.Keychain.setAuthUserToken(token, accessGroup)
  limitations:
  - Apple ecosystem only; no Android equivalent published yet
  - requires both apps to share one App Store account (game transferred to the
    Galactica Games account)
- id: sandbox_helper
  description: >-
    HelpersService.VerifyPlayerToken emulates the user's in-app confirmation so
    the linking handshake can be automated in integration tests. Test mode only.
unauthenticated_operations:
- linq.geo.restrictions.v2.RestrictionsService.IsAccessAllowed
notes:
- No /.well-known/openid-configuration or /.well-known/oauth-authorization-server
  is published; there is no OAuth scope surface, so no scopes/ artifact exists.
- Tokens carry no published expiry, so there is no documented refresh flow.