Authentication

Create the player and obtain an access token via the REST API before opening the store

Before the store can be opened, the player needs an access token. Your app (ideally your backend) creates the player once using your app's internal user ID, then logs them in with federated login to receive the token.

Use https://dev.playsuper.club as the API base URL during development, and https://api.playsuper.club in production. See Environments.

Step 1: Create the player

curl -X POST https://api.playsuper.club/player/create-with-uuid \
  -H "Content-Type: application/json" \
  -H "x-api-key: YOUR_API_KEY" \
  -d '{"uuid": "your-unique-player-id"}'

Body field	Type	Required	Description
`uuid`	string	Yes	Your app's unique identifier for this player

Response 201 (the data payload of the standard response envelope):

{
  "message": "Player created successfully",
  "playerId": "d2f1a3b4-5678-90ab-cdef-1234567890ab"
}

This endpoint is find-or-create: calling it again with the same UUID returns the existing player, so it is safe to call on every app launch.

Step 2: Log the player in

Authenticate the player with federated login to receive their access token:

curl -X POST https://api.playsuper.club/player/login/federatedByStudio \
  -H "Content-Type: application/json" \
  -H "x-api-key: YOUR_API_KEY" \
  -d '{"uuid": "your-unique-player-id"}'

Body field	Type	Required	Description
`uuid`	string	Yes	The same UUID used in Step 1

Response 200 (this endpoint returns its body directly, without the response envelope):

{
  "message": "Login successful",
  "access_token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9..."
}

Returns 404 if no player exists for that UUID — make sure Step 1 ran first.

This access_token is what you will pass to the store URL in the next guide.

Keep your API key on the server

Ideally, make these calls from your backend and hand only the access_token to your app, so your API key is never shipped inside the app binary.

A minimal backend endpoint that your app can call to get a token:

// Node.js / Express — your app calls this instead of PlaySuper directly
app.post('/playsuper/token', async (req, res) => {
  const uuid = req.user.id; // your app's authenticated user ID

  const headers = {
    'Content-Type': 'application/json',
    'x-api-key': process.env.PLAYSUPER_API_KEY,
  };

  // Find-or-create the player (safe to call every time)
  await fetch('https://api.playsuper.club/player/create-with-uuid', {
    method: 'POST',
    headers,
    body: JSON.stringify({ uuid }),
  });

  // Federated login → access token
  const login = await fetch('https://api.playsuper.club/player/login/federatedByStudio', {
    method: 'POST',
    headers,
    body: JSON.stringify({ uuid }),
  });

  const { access_token } = await login.json();
  res.json({ accessToken: access_token });
});

Token lifetime and caching

The token stays valid across sessions until it expires — cache it on the device instead of logging in on every launch.
When the store shows the player as logged out, the token has likely expired — re-run the federated login and reopen the store with a fresh token (see Session Management).

Next, build the store URL with the token you just obtained in Store URL.

Step 1: Create the player

Step 2: Log the player in

Keep your API key on the server

Token lifetime and caching

On this page