Player Authentication Modes

TurnKit supports three ways for players to authenticate. OPEN is the default and fastest option.

Quick Comparison

Mode	Best for	What you need	Player verification
OPEN	Quick testing and prototypes	Nothing	None
TURNKIT_AUTH	Simple email login without building a backend	SMTP settings (host, port, username, password, from address)	Email + OTP -> player JWT
SIGNED	Games with existing player authentication	Your own backend + secret key	Signed exchange -> player JWT

OPEN Mode

No authentication is required. Players only need your client key to join queues and matches.

This is the fastest way to start testing, public demos, or games where you prefer zero login friction.

Note: Do not use OPEN mode with auto-upgrade billing. Malicious users could create many fake players and consume your free 20 CCU limit.

TURNKIT_AUTH Mode

TurnKit manages player login using email + OTP.

How to implement

Set mode to TURNKIT_AUTH in the dashboard.
Configure your SMTP settings. A quick option is setting up Brevo as your email provider.
Client calls /v1/client/auth/otp/request and /v1/client/auth/otp/verify.
Use the returned player JWT in Authorization: Bearer <player-jwt> for normal client calls.

OTP endpoints expect Content-Type: application/json. Default backend limits are currently 5 requests per 10 minutes for /v1/client/auth/otp/request and 10 requests per 10 minutes for /v1/client/auth/otp/verify, typically scoped by game, email, and client IP.

SIGNED Mode

Your backend signs player identities.

How to implement

Set mode to SIGNED in the dashboard.
Store secret key only on your backend.
Backend computes HMAC-SHA256 over playerId + "\n" + timestamp + "\n" + nonce and returns playerId, timestamp, nonce, and signature to the client.
timestamp is Unix epoch seconds encoded as a string.
nonce must be a random URL-safe string, not a time-based value. The server currently requires [A-Za-z0-9_-]{16,128}.
Client calls POST /v1/client/auth/signed/exchange with that payload. TurnKit verifies signature, replay protection, and freshness before issuing a player JWT.
Use that player JWT in Authorization: Bearer <player-jwt> for normal client calls.

OPEN is the only mode that still sends X-Player-Id directly on client requests.

All modes work with MatchWithAnyone().