I'm curious about what the process is for anonymously authenticating users when it comes to mobile games. There are quite a few examples out there, but the ones that immediately come to mind are Lords Mobile, Family Guy: Quest for Stuff, and Clash of Clans. When you first open the game, you're assigned an account id and that id is tied to your device until you choose to register an account with a password or sign in through some SSO service.

In that initial step where you're not creating a password or using SSO, how are these games making sure the requests are from both the user/device that they come from? Or is it that they actually don't?

I can imagine a simple setup where you're providing a key that needs to be refreshed every now and then just like you would with something like OAuth, but other than that you don't care that the user is who they say they are. After all, you're dealing with a request that already has to be validated for legality within the game rules.


I cannot speak to how those games in particular work, but I have worked on other games that behave similarly. Quite simply, the client generates an anonymous id and password for you, similar to any normal profile creation, just without user input. That info is stored on the device. On iOS, it is possible for that data to be saved in the Keychain, where it will even survive the app being deleted and reinstalled. I don’t know if there is something similar on Android, but my guess is that there is.

Your profile can be associated with any number of identities. When you sign in with an SSO or similar, it simply adds your new identity to your existing profile.

|improve this answer|||||
  • \$\begingroup\$ So it is more or less what I thought, then. I'll have a look into those password storing capabilities. Thanks! \$\endgroup\$ – Eric Sep 29 '19 at 16:55

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.