Getting User Info
User info covers personal information such as the user's nickname and avatar, as well as sensitive information such as phone number and real name. OpenPaaS splits it into two levels by data sensitivity, each served by its own API.
| Level | API | Returns | Server involvement |
|---|---|---|---|
| Basic information | sud.getUserInfo | Nickname, avatar | None; usable directly on the client |
| Sensitive information | sud.getUserProfile | Encrypted and signed ciphertext | Required; Game SVR must verify the signature and decrypt |
For API signatures, callback parameters, and examples, see the User Info API.
Basic Information
sud.getUserInfo() returns public basic information (nickname and avatar). Even if this data is intercepted it does not expose core assets, so there is no encryption flow. The path is very short and the client can use the result directly in the UI.
The user's authorization state is verified internally by SUD OP; the game does not need to create its own authorization button or query the authorization state. If the user has not authorized yet, complete authorization through a user-initiated action first.
Users may change their nickname and avatar. If you need to display them over time, persist them on Game SVR and retrieve them again before use instead of caching them once.
Sensitive Information
sud.getUserProfile() returns sensitive data (phone number, real name, and similar) encrypted and signed with the current session's session_key. The client receives ciphertext and cannot decrypt it. Pass rawData, encryptedData, iv, and signature unchanged to Game SVR, which verifies the signature and decrypts the data using the same session_key saved during login.
Game SVR must use the received rawData as-is when verifying the signature and must not parse and re-serialize it; differences in spaces, line breaks, or escaping will cause verification to fail. Sensitive data is encrypted with AES-128-CBC using PKCS7 padding, and the signature is SHA1 over rawData concatenated with session_key. Only collect and store the sensitive fields the current business explicitly needs and the user has authorized.
Recommended Usage
- Complete login first: obtain
codeand let Game SVR exchange it for session data. See Session Management. - When you only need the nickname and avatar, call
sud.getUserInfo()and avoid introducing a server-side encryption and decryption path. - Call
sud.getUserProfile()only when you genuinely need sensitive fields such as phone number or real name, and follow the data minimization principle. - For the complete flow and copy-ready orchestration code, see Login and User Info Retrieval Flow.