Session Management

Minigames can obtain the open platform's user identifiers through the login capability provided by OpenPaaS and quickly establish a user system within the minigame.

Description

1. Call the sud.login API provided by OpenPaaS to obtain the temporary login credential code, then submit code to your developer server.
2. The developer server uses code to call auth.code2session to obtain the user session data, then generates its own session based on the user identifier. That session is used to identify the user in subsequent client-server interactions.

User identifiers returned by auth.code2session:

Parameter	Type	Description
openid	string	Unique identifier of the user within the current minigame, used to identify the user inside the minigame
unionid	string	Unique identifier of the user under the open platform account
session_key	string	Session key, used to encrypt and verify sensitive user data

Note:

1. The session key session_key is the key used to encrypt and sign user data. For the security of your own application, the developer server must not deliver the session key to the minigame, nor provide this key to any external party.
2. The temporary login credential code can be used only once.
3. auth.code2session must be called from the server. The request carries game_id and secret, which must never appear in client code.