#Player accounts

Players sign in once to the arcade with their Gamesight Google account, and the session is shared across every game. Because the whole arcade is same-origin, the session cookie reaches your game automatically, so you never build a login.

Identity is the user's Workspace email. The SDK gives you { email, name, picture }.

#From a game using the SDK

<script src="/sdk/v1/arcade.js"></script>

Arcade.init();

const user = await Arcade.auth.getUser();   // { email, name, picture } | null
if (!user) Arcade.auth.login();             // full-page redirect to Google, returns here
// ...later:
await Arcade.auth.logout();

// React to sign-in/out (fires once immediately, then on tab focus):
const off = Arcade.auth.onChange((u) => render(u));

getUser() returns null when signed out or when the API is unreachable (genuinely offline). Treat both as "not signed in".

#Without the SDK (same-origin fetch)

The endpoints are plain HTTP under /api/auth/*:

Always send credentials: "include" (or "same-origin") so the cookie rides along.

#Local development (no Google needed)

Locally the API runs in dev-auth mode: GET /api/auth/login mints a session for dev@gamesight.io immediately, with no Google round-trip. Impersonate another user with ?email=alice@gamesight.io, which is handy for testing two players. This is dev-only, gated on dev-auth mode, and ignored in production. Sessions live in .data/sessions.json and survive restarts.

The switch to real Google OIDC is automatic: the Lambda is in google mode whenever the OAuth client secret is configured, and dev otherwise.

The session also gates multiplayer: /api/realtime/info mints a short-lived token from the signed-in session, so signed-out players can't open a realtime socket. See multiplayer.

See also: leaderboards · saving game data · multiplayer.