> For the complete documentation index, see [llms.txt](https://docs.ggwp.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.ggwp.com/ggwp-client-sdk/authentications.md).

# Authentications

Two authentication modes are supported for the GGWP SDK:

| Auth Mode      | Use Case               | Security | Environment |
| -------------- | ---------------------- | -------- | ----------- |
| Static Tokens  | Quick setup & testing  | Low      | Development |
| Dynamic Tokens | Production deployments | High     | Production  |

### Static Tokens

Static tokens are cryptographic keys used to enable secure access and signing for various operations within your application. These tokens provide a straightforward mechanism for authentication and data integrity, ensuring secure communication between SDK and GGWP Server.

In this mode, the two static tokens - access and signing, are generated by GGWP and shared with the customers directly. 

The data flow is represented below:

<figure><img src="/files/yg8FGD1955SSIIGCVvkG" alt=""><figcaption></figcaption></figure>

**Pros**

* No server side work required
* Fast to setup

#### Cons

* Less secure
* If the tokens are leaked then you may need to release a new build (if game does have its own server for token distribution)
* Same tokens are used to send data for all the users

### Dynamic Tokens

In this mode access and refresh tokens are used for secure authentication and session management by the GGWP SDK. The access token is a short-lived token used to access protected resources, while the refresh token is a long-lived token used to obtain new access tokens without requiring re-authentication.

This mode requires the Services Server to build an authcode-request API which [initiates token requests](#auth-code-api) to the GGWP Server. The GGWP SDK requires this authcode during the SDK initialization process. It is expected that the Game Client would be making this authcode request call securely to its own services server using the existing security protocol designed for the information exchange between the Game Client and Services Server. Once initialization is complete, the GGWP SDK takes care of retrieving and maintaining the access/refresh tokens.

The data flow is represented below:

<figure><img src="/files/46b2fxCfPEsJ7NBj7Awy" alt=""><figcaption></figcaption></figure>

#### ***Pros***

* Tokens are short-lived and bound to a user. In case of leak, the damage is isolated and limited for a small duration
* Tokens are temporarily stored securely and would be difficult to retrieve
* Can be revoked remotely

#### ***Cons***

* Needs work on the server side too for it to work

#### Auth Code API

This step is done between the Services Server and GGWP Server using an `x-api-key` header for authentication. You will receive an authcode back, This authcode is only valid for 5 minutes and can be exchanged to get a temporary access token.

**Parameters**

`headers`

* x-api-key: the GGWP API key corresponding to your organization and dashboard.

`body`: Dictionary containing the following fields:

* user\_id: Unique identifier of the logged-in player or user
* scope: An array of permissions required for the session. Valid values are `write:voice`, `write:chat`, `write:reports` and `write:discord`

```bash
curl --request POST "https://client-api.ggwp.com/auth/v1/authorize" \\
  --header 'x-api-key: <API_KEY>' \\
  --data-raw '{
    "user_id": "USER ID of the user",
    "scope": ["write:voice", "write:chat"]
  }'
```

**Output**

* 200 - successful operation

```json
{
  "code": "00000000-0000-0000-0000-000000000002.1bea101b-12d2-47c4-9407-0fbae3ab7691"
}
```

* 400
  * Bad Request: Indicates that the request contains incorrect or malformed data.
* 403
  * **Forbidden**: Indicates that the server understands the request but refuses to authorise it.
    * It could happen because of an invalid token, a mismatched user\_id, or
    * When the rate limit is exceeded
* 500
  * **Internal Server Error**: Indicates that the server encountered an unexpected condition that prevented it from fulfilling the request.