Session Management

The store persists the player's session in the WebView's localStorage, which survives across app launches. This page covers how to work with that session: caching tokens, refreshing expired ones, and cleanly switching players.

How the session works

On first open, the store reads apiKey and authToken from the query parameters, saves them to its own localStorage, and strips them from the address bar.
On later opens, the store restores the session from localStorage — passing the same token again is harmless.
The session lives in the WebView's storage, independent of your app's own login state — which is why logout needs explicit handling (below).

Token caching

Cache the access_token on the device (or in your backend, keyed by user) instead of calling federated login on every launch:

App launch
  ├── Cached token exists → open store with cached token
  └── No cached token     → federated login → cache token → open store

The token stays valid across sessions until it expires.

Handling token expiry

When the token expires, the store shows the player as logged out. There is no refresh endpoint — obtain a fresh token the same way as the first one:

Re-run the federated login from Authentication.
Replace the cached token.
Reopen the store with the fresh authToken.

Logout and switching players

When a user logs out of your app (or a different user logs in on the same device), the previous player's session is still sitting in the WebView's localStorage. Open the store once with clearSession=true so it is wiped before the new credentials are applied:

https://store.playsuper.club/?clearSession=true&apiKey=YOUR_API_KEY&authToken=NEW_ACCESS_TOKEN

Scenario	What to do
Same player, new session	Nothing — reopen the store normally with the cached or refreshed token
Player logs out of your app	Delete your cached token; on the next store open (by any user), pass `clearSession=true`
Different player logs in	Get the new player's token, then open the store once with `clearSession=true` and the new `authToken`

Skipping clearSession after an account switch is the most common cause of the "previous user's data appears in the store" bug. Set a flag when your app's user logs out, and consume it on the next store open.

A simple pattern:

// Pseudocode — track logout in your app's storage
function onAppLogout() {
  deleteCachedPlaySuperToken();
  setFlag('playsuper_clear_session', true);
}

function buildStoreUrl(apiKey, authToken) {
  const params = { apiKey, authToken, utm_content: 'main_menu_button' };
  if (getFlag('playsuper_clear_session')) {
    params.clearSession = 'true';
    setFlag('playsuper_clear_session', false); // one-time
  }
  return 'https://store.playsuper.club/?' + new URLSearchParams(params);
}

Next, award coins and react to store purchases in Coins & Transactions.

Session Management

How the session works

Token caching

Handling token expiry

Logout and switching players

On this page