Keep the sign-in button on your studio website
Use the browser SDK to start sign-in on your HTTPS game website. The permission window authenticates the player on Vihar, returns a one-use code to the exact registered opener origin, and the SDK exchanges it using an S256 PKCE verifier. The code expires after 60 seconds; access tokens expire after 12 hours.
This is Vihar's game integration protocol, not a general OpenID Connect provider. There is no client secret to embed in a browser, no arbitrary redirect URI, no discovery document, no refresh token and no permission to reuse Firebase credentials. Tokens are opaque and stored hashed on the Vihar server.
Verify the token before trusting a player ID
Never trust a sub, username or avatar supplied directly by the browser without verifying its token. Hardcode or securely configure your expected game ID on the backend. A token issued to another game fails verification even if the player account is the same.
Vihar ID tokens are bearer credentials. Do not log them, put them in URLs, send them to analytics or retain them in localStorage. The browser SDK uses tab-scoped session storage when available. Reverify before sensitive operations and end your own game session when Vihar reports expiration or revocation.
// In the browser, after signIn():
const token = vihar.getAccessToken();
// Send token to YOUR OWN HTTPS backend using Authorization: Bearer.
// On your Node.js server (game ID must be server configuration):
const response = await fetch("https://vihar.online/api/vihar-id/me", {
method: "POST",
headers: {
"Content-Type": "application/json",
Authorization: `Bearer ${receivedToken}`
},
body: JSON.stringify({ gameId: process.env.VIHAR_GAME_ID })
});
if (!response.ok) throw new Error("Vihar ID connection is invalid");
const player = await response.json();
// Map player.sub to this game's account.
// Issue your own secure, HttpOnly game session cookie.HTTP endpoint contract
All endpoints are POST /api/vihar-id/{action} with application/json and gameId in the JSON body. me returns { sub, gameId, username, displayName, avatarId }. save accepts operation read or write; writes also require data and revision. revoke ends the supplied token.
session accepts operation start, pulse or end and a random sessionId of 20–80 letters, digits, underscores or hyphens. Pulse/end require an increasing integer sequence and elapsedMs between 0 and 45000. Start is idempotent for the same token and session ID; duplicate or older pulses do not add time. Use the SDK unless you need a native engine adapter.
Browser requests must come from the registered origin. Your backend may call authenticated me/save/session/revoke without an Origin header. That does not bypass game binding, expiry or connection revocation. The code-exchange endpoint requires the registered Origin and, for identity, the original PKCE verifier.
Downloadable and native games
A download-page click is not gameplay. For an installed game, put Vihar ID sign-in on your studio's registered HTTPS website and connect it to your own backend. Use your existing secure browser-to-app handoff to give the installed game your own game session; do not put a Vihar token into a custom-scheme URL.
Your backend can report real sessions for the authenticated player using the session endpoint. It must preserve the Vihar token securely, honor revocation, pause when the native game pauses, and prevent duplicate devices from reporting simultaneously. The provided JavaScript SDK is for browser games; a native engine adapter and app handoff are the studio's responsibility.
Run the integration test through the actual gameplay reporter. Starting a timer on the marketing or download page does not meet the tracking requirement.