Table of Contents

OSL Token Verification

OSL Token Verification provides a Unity request manager and a .NET 10 backend starter for checking Google, Facebook, Apple, Steam, and Discord login results outside the game client.

Overview

Use this package when a Unity project has already acquired a provider credential but should not trust the client callback by itself. Google and Apple identity tokens are validated as JWTs; Facebook, Steam, and Discord credentials are checked through their provider service APIs.

Included Components

  • TokenVerifyManager for Unity-side verification requests
  • A sample scene at Assets/OSL/TokenVerification/Samples/Scene/DemoScene.unity
  • A .NET server source archive at Assets/OSL/TokenVerification/Server_Dotnet_Source.zip in the exported package
  • Provider-specific endpoints for Google, Facebook, Apple, Steam, and Discord
  • Deny-by-default CORS, Development-only Swagger, per-IP rate limiting, request-size and provider-timeout bounds, /healthz, correlation IDs, structured credential-safe errors, and identity-safe Unity logging

Basic Setup

  1. Import OSL Token Verification into the Unity project.
  2. Extract Server_Dotnet_Source.zip to a local working folder, keep credentials out of appsettings.json, and configure them through environment variables or a protected provider.
  3. Start the extracted .NET project with dotnet run.
  4. Open the sample scene, set the TokenVerifyManager server URL, and run a verification request with a valid provider token.

Requirements

  • Unity 2021.3 LTS minimum
  • Unity 2021.3.45f2 and 6000.3.12f1 tested for package-isolation import and compile
  • .NET 10 SDK for the included backend template
  • Provider credentials configured only in the extracted server project

The included server is a starter with safer defaults, not a verified production deployment. Configure HTTPS, secret management, monitoring, account linking, session issuance, and project-specific abuse policy for your own environment.

Edit this page