invalid_origin or integration_required
Integration registration is owner-only and requires verified email. verify_email means verify your account and refresh its sign-in token; not_owner means you are using a different listing owner's account.
- Compare the game's saved URL, Creator studio registration and the actual location.origin on the game page.
- Use the exact HTTPS origin, including www if present. Redirects to another hostname need a matching saved URL and a new registration.
- Save URL or access-mode changes as a draft, select Register saved game URL again and repeat the integration test.
- Do not solve CORS errors by forwarding a Vihar Firebase token to the game. Use the SDK's scoped token flow.
popup_blocked, popup_closed or login_timeout
Call signIn directly from a click handler. The SDK opens the popup before awaiting cryptography. Allow popups for the game and avoid embedding the sign-in flow inside a sandbox that prevents opening a window.
If your game sends Cross-Origin-Opener-Policy: same-origin, it can sever the popup connection. Use a deployment compatible with cross-origin authentication popups, such as same-origin-allow-popups, and test your engine's isolation requirements. A five-minute timeout means start sign-in again; do not reuse an old code.
invalid_code, invalid_verifier or session_expired
A code is one-use, valid for 60 seconds and bound to its game and origin. Start a new login or Vihar launch if it was exchanged already or arrived too late. Keep the PKCE verifier inside the same SDK sign-in operation.
session_expired means the 12-hour token is missing or expired. Sign in again for an account game or launch from Vihar for a direct-play game. connection_revoked means the player disconnected; only a new player-initiated connection should restore access. identity_required means an activity-only connection tried to read identity or saves.
session_active, session_replaced or invalid_duration
Only one active session per player and game can report at once. Close the other tab or wait 90 seconds after its last report. Stop a round before starting another and keep a stable session ID for retrying a start.
Send a strictly increasing sequence for pulse/end, elapsedMs as an integer from 0 to 45000, and stop accumulating time in menus and hidden tabs. Duplicate reports add nothing; reports arriving after a long network gap cannot backfill unobserved play time.
If test verification stays pending, confirm the owner account is used, the game actually called startSession and at least one heartbeat credited time. Account-mode games must test with an identity token from the on-site sign-in button, not only an activity launch ticket.
save_conflict, save_too_large or rate_limited
For save_conflict, load the latest save and resolve changes deliberately before retrying. For save_too_large, keep the JSON object under 60 KB and store large assets on your own infrastructure. For rate_limited, wait a minute and reduce retries or autosave frequency.
A service_unavailable response means the service cannot complete the operation. Preserve local unsaved game state, show a retry option and contact support if it persists. Do not expose raw tokens or request bodies in logs or screenshots.