Authentication & Identity

Every player has one HELIX identity. There is no per-world signup: when a player opens a world, they're already signed in (or they play instantly as a guest and can upgrade later). Your world never handles passwords — it receives a verified identity from the platform.

The launch flow

When a player opens a world, the HELIX shell asks the backend for a short-lived, world-scoped world session token (POST /api/v1/instant-worlds/:worldId/session) and hands it to the SDK in the helix:init handshake. It is not the player's platform access token: it only carries the scopes the world's manifest declares. The SDK exposes the player from it.

const { embedded, world, user } = await Helix.init(); // no arguments; the shell supplies the session

if (Helix.auth.isAuthenticated()) {
  const me = await Helix.auth.getUser(); // { id, username, displayName }
}

// The generated Unreal service mirrors Helix.auth. Requests are objects you dispatch.
UHelixAuthService* Auth = UHelixSdkServices::GetAuthService(this);
UHelixAuthGetUserRequest* Request = Auth->GetUser();
Request->OnFinished.AddDynamic(this, &AMyActor::HandleUser); // UFUNCTION void HandleUser(UHelixRequest*)
Request->Dispatch();
// In HandleUser: Cast<UHelixAuthGetUserRequest>(R)->HasResult() / GetResult()

When a player later joins a multiplayer room, the backend mints a separate, short-lived room credential (a JWT with a different audience, so a world session token can't be replayed to join a room). The room verifies it before admitting the player. You don't handle either token by hand: the SDK and shell wire them up.

Helix.auth (Web SDK)

Helix.init() resolves with { embedded, world, user, runtimeFidelity, customizerSubject, customizerSource }. When the world is opened outside the shell, embedded is false and identity returns null.

Guests

A visitor who opens your link can play immediately as a guest. In the Web SDK a guest has no session: isAuthenticated() is false and getUser() resolves null. Guests can still join multiplayer rooms, because multiplayer is the only scope the backend grants a guest session; account-bound scopes (profile, voice, camera) are never minted for one. Call requestLogin() to let a guest sign in without reloading the world. Eligible new accounts get a one-time starter grant of LIX Credits, which pay for platform services.

Permissions

A world declares the scopes it needs in the permissions array of its manifest (helix.json). The known scopes are auth.profile, multiplayer, voice.room, voice.proximity and camera.capture. The session the platform mints carries the declared scopes intersected with that list; there is no per-player consent prompt. Request only what you use: a room join needs multiplayer, and a route that requires a scope the session lacks answers 401 Insufficient world scopes.

Reference

• Web SDK → Helix.auth
• REST → GET /api/v1/users/me (the signed-in account, with a platform access token)