View on Asset Store (opens in new tab)
Package details
- Latest version
- 2.0.0
- Last updated
- First released
- Unity version
- 6000.3.12 or later
- Package size
- 70 KB
- Files
- 13
- Views in the past week
- 4
Price tracking
- Last checked
- Tracked since
- Lowest recorded
- $7.99 on
Keywords
OSL Social Token Verification - .NET Backend Starter
A Unity client and .NET 10 backend starter for verifying Google, Facebook, Apple, Steam, and Discord login results on your server with production-safe defaults.
Affiliate link · Purchases support this site
Price history
Last 6 months
USDAsset preview
1 / 1
OSL Social Token Verification - .NET Backend Starter screenshot 1
About this asset
OSL Token Verification is for Unity developers who already receive social sign-in credentials but need to check them on infrastructure they control. It combines a Unity HTTP client with a .NET 10 ASP.NET Core Minimal API starter for Google, Facebook, Apple, Steaam, and Discord verification flows.
Why / Key Benefits
- Move verification to your server: Do not treat a client-side login callback as proof of identity.
- Start with five provider endpoints: Connect Google, Facebook, Apple, Steam, and Discord credential flows to one backend project.
- Use the correct provider mechanism: Validate Google and Apple identity tokens, and use Facebook, Steam, and Discord provider APIs for their respective credentials.
- Keep secrets outside Unity: Store provider secrets, keys, and Web API credentials in backend configuration rather than the distributed client.
- Reduce integration boilerplate: Use `TokenVerifyManager`, request/response models, a sample scene, and the included server source archive as a starting point.
- Avoid repeated Apple key downloads: Reuse Apple's JWKS through a 12-hour in-memory cache.
- Start from safer server defaults: Use an exact CORS allowlist, Development-only Swagger, per-IP rate limiting, request-size and provider-timeout bounds, a health probe, correlation IDs, and structured redacted errors.
Typical Workflow
1. Acquire a credential from the provider's Unity or platform login flow.
2. Send it through `TokenVerifyManager` to the corresponding backend endpoint.
3. Let the .NET 10 starter validate the token, code, or ticket using the provider-specific mechanism.
4. Use the verified provider identity in your own account and session-issuing logic.
Requirements
- Minimum Unity Version: Unity 2021.3 LTS
- Tested Unity Versions: Unity 2021.3.45f2 and Unity 6000.3.12f1 (package-isolation import and compile)
- Backend runtime: .NET 10 SDK/runtime
- Provider setup: Credentials and dashboard configuration for each enabled provider
- Supported starter endpoints: Google, Facebook, Apple, Steam, and Discord
Limitations / Scope
- The included server is a starter, not evidence of a production deployment. Configure hosting, HTTPS, secret management, monitoring, account linking, session issuance, and project-specific abuse policy for your environment.
- Verification is provider-specific: Facebook, Steam, and Discord rely on their official service APIs rather than local JWT signature validation.
- Provider login success and production hosting were not verified by the package-isolation compile tests.
Documentation & Support
From the publisher's Asset Store listing.
Technical details
- Architecture: The Unity client uses `UnityWebRequest` through `TokenVerifyManager`; the server source targets .NET 10 and ASP.NET Core Minimal APIs with a bounded provider HTTP client that avoids URI logging for query-carried credentials.
- Google: Validates Google identity tokens with the Google validation library, including configured audience checks.
- Apple: Resolves Apple JWKS, validates the JWT signature and claims, and caches the key set in memory for 12 hours.
- Facebook: Calls Facebook's `debug_token` API with configured application credentials.
- Steam: Sends the escaped session ticket to Steam's `AuthenticateUserTicket` API.
- Discord: Exchanges the authorization code and queries Discord's user API while validating configured redirect parameters.
- Production defaults: Exact deny-by-default CORS allowlist, Development-only Swagger, per-IP fixed-window rate limiting, bounded request bodies, configurable provider timeout, `/healthz`, and validated `X-Correlation-ID` propagation.
- Error and log contract: Failures return stable `code`, `message`, and `correlationId` fields, which the Unity response model exposes. Provider bodies, exception details, raw credentials, and identities are excluded from server and Unity client logs and from client error responses.
- Compatibility: Version 2.0 requires .NET 10. The released 1.1.2 archive remains the .NET 8 fallback during migration.
- Packaging: The repository keeps the canonical archive under `Server~/`; `.unitypackage` export stages it as `Assets/OSL/TokenVerification/Server_Dotnet_Source.zip` for extraction outside Unity.
- Demo UI: The sample can bind legacy Unity UI or TextMeshPro when available and provides an OnGUI fallback.
Compatibility
| Unity version | Built-in | URP | HDRP |
|---|---|---|---|
| 6000.3.12f1 | Compatible | Compatible | Compatible |
Fully compatible with Built-in, URP, and HDRP.
Technical Details:This asset focuses on Backend Verification and Network UI. It contains no pipeline-specific shaders or materials. The Demo Scene uses Standard UGUI, working seamlessly in any rendering environment without extra setup.
Requirements:
- Unity UI (UGUI): Auto-installed via package.json.
- .NET 8.0 SDK: Required to run the C# Backend Server.
As listed on the Asset Store.