I am creating a MOBA game and I will host tournaments which will be visible on the website. to join the game, you must be logged in on the website and browse the tournaments list and select a tournament and click play.

Clicking play will launch a custom protocol like thegame://launch-tournament/tournament-id/

and the game client will open for the given tournament id.

Now, I don't want the players to login again on the game client, I want them to automatically login because they are already logged in.

How can I securely log them in automatically with this idea?


2 Answers 2


You could use something like a unique session ID. This means, your custom protocol would be


How it works:

  • When the player klicks on the selected tournament in his webbrowser the server generates a unique identifer and stores it for some time. Just a few minutes.
  • Then this code will be appended to the link.
  • When the Gameclient launches, it sends this code to the server. It works like a one time login token.
  • The Server checks if the code is valid. If so, it will transmit the user information to the client and the player can start using his account.

To prevent fraud, the whole communication should be encrypted.

Additionally the server could store the IP of the Webbrowser together with the token and checks if the IP of the client using the token to login is the same.

  • 1
    I'm not so sure about the IP part, since some gamers use a proxy for the game but not the web browser in order to improve their ping or packet loss. Nov 12, 2015 at 8:53

generate a ID containing lot of random number (the more the better 128bit seem largely enough) store it with espiration time / client ip adress / client account / game to join (you can concatenate this to the random number or store it on your server).

the game will send the ID to the authentification server this one will check and delete the token and send client necessary information for join the game and say to the game server to accept this client.

implementation detail : -you can generate the random id partially in the client browser making harder to guess the next id even if your server random generator is predictible.

-remenber to delete espired and never check id or you will have a ram problem

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .