Login Credential Verification

This interface should be called on the server side. It must never be called directly from the front end (APP client, web page, minigame, etc.) to avoid the risk of credential leakage.

Interface Description

Interface Name auth.code2session

Description Login credential verification (code2session). The minigame server uses the code obtained at login to exchange it for user session information.

Note: This interface is called directly as a standard HTTPS request and does not support service communication secondary encryption and signatures. Pass game_id, secret, code and other parameters as plaintext query parameters; the response is plaintext JSON. No encrypted payload, signature headers, or response decryption are needed.

Call Method

HTTPS Call

GET /v1/auth/code2session

Prepend the base URL for your game's service region to the API path. See Service Regions and API Addresses.

Request Parameters - Query

Field	Type	Default	Required	Description
game_id	string		Yes	Game ID
secret	string		Yes	Game secret
code	string		Yes	The code obtained at login
grant_type	string		Yes	Grant type, fixed as authorization_code

Response

The returned JSON data package

Field	Type	Description
errcode	int32	Error code
errmsg	string	Error message
session_key	string	Session key
openid	string	Unique user identifier
unionid	string	Unique user identifier within the game group
legacy_user_identity	string	Legacy user identity information
channel_id	int32	Channel ID: 0-Other, 1-OPPO, 2-HONOR, 3-XIAOMI

Example

Request Example

GET /v1/auth/code2session?game_id=xxx&secret=xxx&code=xxx&grant_type=authorization_code

Response Example

{
  "errcode": 0,
  "errmsg": "ok",
  "session_key": "Wh/vJSqjuUvFiX7Zaecgrw==",
  "openid": "176587c7ae606feb7d837852b17e7d76",
  "unionid": "9e8d7a9f9c0d581b57f131583e1702b8",
  "legacy_user_identity": "xxx",
  "channel_id": 1
}