Player tokens
A player token is how your game tells Appside who is buying, without a login screen and without Appside calling your server to authenticate. It's a compact JWS (JWT) signed by your backend with ES256 (P-256).
Claims (all required unless marked)
| Claim | Value |
|---|---|
alg (header) | ES256 |
kid (header) | id of a public key you uploaded in Studio → Integration |
iss | your issuer string, exactly as configured |
aud | appside:store:<storeId> |
tenant | your store id |
player_id | your stable player id (≤ 200 chars) |
nonce | 16–128 chars [A-Za-z0-9_-], unique per token |
exp | ≤ 5 minutes after now |
iat, nbf | optional |
Rules Appside enforces
- Single use: the nonce is consumed atomically. Opening the same token twice fails with Player assertion already used.
- Short-lived: anything over 5 minutes is rejected.
- Your keys only: Appside accepts public JWKs only. Uploading a private key is refused.
- Rotation: upload the new public key next to the old one, switch your backend to the new
kid, wait 5 minutes, then remove the old key.
Never in the client
Signing keys stay on your backend. The app asks your backend for a fresh token each time it opens the store.