What is the best login flow if you want to auto-login someone to Steam?

Question

question

Dylan Hunt asked Mar 12, '17

What is the best login flow if you want to auto-login someone to Steam?

(EDIT: This is for a premium PC game, so the login flow example for a free mobile game doesn't help much, unfortunately. People already purchased the game by the time they get to this screen + want to ensure they purchased the game. The login example on GitHub is deprecated and tells us to look at recipes for an example, but there was never a login example added to the recipes O__o)

Currently, this is our login flow:

Semi-Anon login via device ID to get title data
Register/Login via FB ||
Register/Login via email+pass (NEW account - not attached to semi login).
Verify inventory upon logging in -- if a "game key" item in playfab inventory, allow access.
IF NO KEY, advertise purchase.

Now that we have Steam, I'm a bit confused when to add Steam automatically:

Semi-Anon login via device ID to get title data
Register/Login via FB ||
Register/Login via email+pass (NEW account - not attached to semi login) ||
Register/Login via Steam
Upon logging in successfully, automatically link current Steam account (probably FORCEFULLY?).
Verify inventory upon logging in -- if a "game key" item in playfab inventory, let them in.
IF NO KEY, check current Steam account (via Steamworks API) if they have a verified key for your game.
IF STILL NO KEY, advertise purchase.

_______________________________

QUESTIONS:

Would this flow work well?
What is the recommended flow?
Any tips to do this better?

_________________________________________________________

CONCERNS:

Let's say the game key is verified through Steamworks - I add a game key to their inventory. What if they made a new account, linked the same Steamworks that has a key, and logged in again? That means THAT account will also get a "free game key". They could potentially do this unlimited times.
Let's say that the game key is verified through Steamworks - and I don't add a game key to their inventory. I wouldn't ever know if they have a game key if they login via our website because they won't have a PF inventory item for the game key.

Obviously there's something wrong with this flow. I'd love to know what that is :)

apis

10 |1200

Attachments: Up to 2 attachments (including images) can be used with a maximum of 512.0 KiB each and 1.0 MiB total.

Answer 1 · 2017-03-13T01:06:05Z

brendan answered Mar 13, '17

There isn't a recipe for login specifically, as all the recipes have to log in the player, meaning they all show how to do it (however, they don't have a Steam-specific example). The concept of the recipes isn't quite the same as a sample, to be clear. A sample is something which, as you say, shows how to do a single thing as simply as possible. The recipes were designed to be slightly more complex examples - how to do daily rewards, referral bonuses, etc.

For games that are specifically distributed through Steam, the players are (generally speaking) signed into Steam whenever they play, via the Steam dashboard app. If they are, you can get their Steam Ticket without interrupting the player at all, via Steam - that would be our main recommendation.

2

10 |1200

Attachments: Up to 2 attachments (including images) can be used with a maximum of 512.0 KiB each and 1.0 MiB total.

Dylan Hunt commented · Mar 13, 2017 at 04:25 AM

"you can get their Steam Ticket without interrupting the player at all, via Steam - that would be our main recommendation."

Yea I believe so too. My main concern is... what to do about the existing accounts? Many people already made accounts with either FB or username+pass (and included a username). Even if I allow "force linking" for FB, it wouldn't include their email+pass and username. In fact, their desired username would "already be taken" from their existing non-steam account.

What would you suggest? This is where I get confused.

One thing I have in my head is: Log people in via Steam automatically. They can click the "login via steam" button to login right now. However, if they login via FB or email+pass, immediately force link Steam right after. Would this approach have any cons?

0 ·

brendan Dylan Hunt commented · Mar 13, 2017 at 04:53 AM

Yes, that's very similar to adding FB to an existing account created with a Device ID. If the player has an account already, you need a way to get them to it. If you have a locally saved Custom ID, etc., then that's easy, but if the player was on another device, then you need a way to get them to that account, so that you can then link the Steam account to it. So your approach is a good one - let them choose to get to their existing account the way they're used to, then link Steam to it. Or, if they choose to just sign in via Steam to start, give them a path to find their existing FB or Username/Password account and force-link their Steam account to that.

1 ·

question