Standardized authentication API for Metaplay apps: login, refresh tokens, revoke sessions, and OAuth2/JWT validation.
application/jsonJSONJWT, signed with RS256Login with email/phone number & password.
Returns: access_token (15 minutes), refresh_token (7 days).
Refresh access_token using refresh_token.
Revoke token & close current session.
Retrieve user info from access_token.
| Scope | Description |
|---|---|
openid | Request ID Token for login. |
profile | Read display name, avatar, language. |
email | Read verified email. |
offline_access | Provide refresh token. |
curl -s -X POST \
https://api.metaplay.example.com/auth/login \
-H 'Content-Type: application/json' \
-d '{
"username": "user@example.com",
"password": "secret",
"scope": "openid profile offline_access"
}'
async function login(username, password){
const res = await fetch('https://api.metaplay.example.com/auth/login', {
method: 'POST',
headers: { 'Content-Type': 'application/json' },
body: JSON.stringify({ username, password, scope: 'openid profile offline_access' })
});
if(!res.ok) throw new Error('Login failed');
return res.json();
}
{
"iss": "https://auth.metaplay.example.com",
"sub": "user_123",
"aud": "metaplay",
"exp": 1719999999,
"iat": 1719990000,
"scope": "openid profile"
}