v0.108.0 Knows Who You Are

A game server can now be sure who a player is. A signed-in player's account arrives proven by fopull.com, so a ban list, an invite list or a leaderboard can trust the id it reads.

Verified players

net.identity(peer).verified used to be false for everyone: a server took a player's word for which account they were. Now a signed-in player joining a server first gets a join token from fopull.com that names that one server and lasts five minutes. The server checks it and reports the player as verified, with the account's id, name and plan as fopull.com has them.

• Your sign-in never reaches the server. A join token proves who you are to the server you are joining and does nothing else: it cannot spend your Fobucks, read your account, or get you into a different server.
• No call to fopull.com per join. A server fetches fopull.com's signing keys once when it starts hosting and checks every token itself, so a busy server never waits on fopull.com.
• net.host{ requireVerified = true } admits only verified players. Anyone else is turned away with a reason their game can show. Without it, a player whose token could not be fetched still joins, unverified, exactly as before.
• A direct host needs to know its address. A server on Floptle Cloud needs nothing: its lobby code is its address. A server players join with quic:// cannot learn its own public address, so tell it: net.host{ port = 30000, address = "play.example.com:30000" }.
• A token works once, for the server it names, for five minutes, with two minutes of leeway for a server whose clock is off. The server's Console says why it refused any token.

The multiplayer guide's "Identity" section covers which address each kind of server answers to.

Lobby codes

A Floptle Cloud or self-hosted relay no longer reuses a closed lobby's code for ten minutes, so a player holding the old code can't land in a stranger's new lobby.

Upgrading

Verification needs both sides on this version: the player's game to fetch the token, and the server to check it. Until a server is updated, its players join unverified, as they do today. Re-export your game and redeploy its server.