How guest players stay signed in on your server, and the two settings that control it.
Guest Sign-in
Players who try your game without an account are guests. Each guest is remembered by their browser with a signed guest token, so nobody can take over a guest hero just by learning its id. The token lasts 180 days and is renewed every time the guest plays, so anyone who keeps playing never has to start over.
Where you'll find it#
| What | Where |
|---|---|
| Guest play on or off | Database → Game Config → Features → Guest Login |
| The two settings below | Your server environment (the .env file or your host's environment page) |
Set it up#
- Make sure your server has a secret: JWT_SECRET (local sign-in) or SUPABASE_JWT_SECRET. Guest tokens are signed from it automatically, nothing else to do.
- Optional: set GUEST_JWT_SECRET to give guests their own separate secret.
- Leave GUEST_LEGACY_UUID_TOKENS on (the default) while players who used your game before this update come back. Their old browser tokens keep working and are swapped for signed ones the first time they connect.
- When the server log stops showing legacy guest sign-ins, set GUEST_LEGACY_UUID_TOKENS=false and restart.
Settings#
| Setting | What it does | Default |
|---|---|---|
| GUEST_JWT_SECRET | Separate secret used to sign guest tokens. Changing it signs every guest out of their saved hero. | Derived from your account secret |
| GUEST_LEGACY_UUID_TOKENS | Keep accepting old unsigned guest tokens and upgrade them on sign-in. | true |
Gotchas#
- A server with no secret at all (guest-only, nothing set) cannot sign tokens, so guests keep using the old unsigned id. Set JWT_SECRET or GUEST_JWT_SECRET to turn signing on.
- Turning legacy off locks out guests who have not played since the update. Their hero is not deleted, but their browser can no longer prove it is theirs.
- Changing JWT_SECRET (or GUEST_JWT_SECRET) invalidates every saved guest token, the same way it signs accounts out.
- A guest who creates an account keeps their hero: the hero moves to the new account the first time they sign in on the same browser.