Connect Web APIs

Use the Connect interface Web APIs to authenticate with your EOS Game Services Web APIs.

To request an access token, the client must make an HTTP request to the EOS Connect token endpoint, passing the ClientId and Client Secret.

EOS Connect token endpoint

https://api.epicgames.dev/auth/v1/oauth/token

Creating an EOS Client Token

An EOS Client Token represents a client application, such as a server, as compared to an individual user.

Clients can be created in the Developer Portal for each product under Product Settings and receive individual policies.

The Client Credentials can be passed either via the Authorization HTTP header or in POST parameters.

EOS Client Token Request

POST /auth/v1/oauth/token

HTTP Headers

Name

Value

Authorization

Basic <Base64(ClientId:ClientSecret)>

Example: Basic Q2xpZW50SWQ6Q2xpZW50U2VjcmV0

Content-Type

application/x-www-form-urlencoded

POST Body Parameters

Name

Value

grant-type

client_credentials

nonce

An optional, arbitrary string value provided by the client.

It will be included in the response for the client to verify the correct nonce value for added security.

Example Request

curl -X "POST" "https://api.epicgames.dev/auth/v1/oauth/token" \
-H "Content-Type:application/x-www-form-urlencoded" \
-H "Accept:application/json" \
-H "Authorization: Basic Q2xpZW50SWQ6Q2xpZW50U2VjcmV0" \
-d "grant_type=client_credentials&deployment_id=<deploymentId>"

EOS Client Token Response

200 - OK: Success

HTTP Headers

Name

Value

Content-Type

application/json

JSON Payload

Name

Description

access_token

The generated EOS Client Token as Base64Url encoded string.

The token describes the verified client caller.

token_type

Always set to bearer

expires_at

Token expiration time. Contains a NumericDate number value, describing the time point in seconds from the Unix epoch.

expires_in

Token lifetime. Seconds since the issue time to when the token will expire.

nonce

An arbitrary string value provided by the client.

Used by the client for added security:

When receiving an access token in HTTP response, the client can verify that the token response includes the correct nonce value.

organization_id

Your organization identifier.

product_id

Your product identifier.

sandbox_id

Your sandbox identifier.

deployment_id

Your deployment identifier.

The access_token can then be used to authorize other EOS Web API calls.

Example Response

{
   "access_token" : "<EOSAccessToken>",
   "token_type" : "bearer",
   "expires_at" : "2021-06-11T23:10:53.491Z",
   "features" : ["Connect", "Voice"],
   "organization_id" : "<OrganizationId>",
   "product_id" : "<ProductId>",
   "sandbox_id" : "<SandboxId>",
   "deployment_id" : "<DeploymentId>"
   "expires_in" : 3599
}