Authentication on current PlayFab titles¶

PlayFab Hub uses the separate PlayFab Unity SDK. Create a title in Game Manager and configure its Title ID in the Hub settings. The title's developer secret belongs only in trusted server/editor tooling.

First login¶

For a new title, start with the Login sample's Register button using a test email and password. Registration captures the session and entity token and raises the same login events as the login methods. Existing accounts use Login. Google Play Games and Apple sign-in require their platform plugins and PlayFab add-on configuration.

Anonymous login is not unconditional account creation. Since June 30, 2025, new titles disable client-side anonymous player creation by default. A generated Custom ID with CreateAccount=true can return PlayerCreationDisabled. The package surfaces an actionable message instead of silently changing title policy.

• Production anonymous accounts should be provisioned by a trusted server before the client logs in. That server authenticates/rate-limits requests and owns the developer secret.
• For a temporary development experiment only, review Game Manager > Settings > API Features and the anonymous creation setting. Do not treat enabling client account creation as a production security design.
• Email registration and platform sign-in are alternatives; choose the policy appropriate for your game.

Microsoft's anonymous login guidance

Session ownership¶

Use one authentication request at a time. The package rejects overlapping authentication attempts because the SDK's static authentication context is shared. Logout cancels pending wrapper callbacks/retries, clears the cached entity identity, and stops queued analytics from crossing into another account. A late login response after logout is discarded and its SDK credentials are cleared before another authentication attempt is admitted.

Do not mix direct SDK authentication calls with Hub-managed login while requests are pending. Shutdown releases Hub timers and subscriptions; it does not intentionally log out an independently owned SDK session. Explicitly call Auth.Logout() when your game needs to forget credentials.

The generated anonymous ID is stored in PlayerPrefs. It is a convenience identifier, not a secure credential or a cross-device account recovery mechanism. Link/register an account when persistence across reinstalls or devices is required.