Guides

Verify on your server

Copy page

Know which player is calling your server. Send a session token from the page, verify it with Lia once, then keep your own session.

Anyone can send your server a request that says "I'm player p_3f9c…". So the page sends a session token that Lia signed, and your server asks Lia whose it is.

#In your page

Send the token with your first request, or with anything that matters. Tokens last 15 minutes; Lia.session() always gives a fresh one.

api.js

export async function api(path, body) {
  const { session } = await Lia.session();
  const res = await fetch(path, {
    method: "POST",
    headers: { "Content-Type": "application/json" },
    body: JSON.stringify({ ...body, session }),
  });
  if (!res.ok) throw new Error((await res.json()).error);
  return res.json();
}

#On your server

server.js (Node.js)

const LIA = "https://api.lialabs.org/api/apps/v1";

async function playerFrom(session) {
  if (typeof session !== "string") return null;
  const res = await fetch(`${LIA}/session/verify`, {
    method: "POST",
    headers: { Authorization: `Bearer ${process.env.LIA_KEY}`, "Content-Type": "application/json" },
    body: JSON.stringify({ session }),
  });
  if (!res.ok) throw new Error(`Lia answered ${res.status}`); // a 401 means your key is wrong
  const result = await res.json();
  return result.valid ? result.playerId : null;
}

app.post("/api/save", async (req, res) => {
  const playerId = await playerFrom(req.body.session);
  if (!playerId) return res.status(401).json({ error: "session" });
  await db.save(playerId, req.body.progress);
  res.json({ ok: true });
});

The same in a Cloudflare Worker:

worker.js

export default {
  async fetch(request, env) {
    const body = await request.json();
    const check = await fetch("https://api.lialabs.org/api/apps/v1/session/verify", {
      method: "POST",
      headers: { Authorization: `Bearer ${env.LIA_KEY}`, "Content-Type": "application/json" },
      body: JSON.stringify({ session: body.session }),
    }).then((r) => r.json());
    if (!check.valid) return Response.json({ error: "session" }, { status: 401 });
    return Response.json({ hello: check.playerId });
  },
};

#Keep your own session

Verifying every request works, but it's a round trip to Lia each time. For an app that talks to its server a lot, verify once and then use your own:

The page signs inIt sends the token from Lia.init() to /api/login.
Your server verifies it with LiaIt gets the player id, and sets your own cookie or token for that player.
Everything after uses yoursUntil it ends; then the page sends a fresh Lia session to log in again.

Cookies set by your page's own site work inside Lia's frame as on the web (cookies for another site may be blocked by the phone, so keep your API on the same site or send a token instead). For a WebSocket, verify the token in the first message (or the connection's query string) before joining the player to anything.

#Checks to make

valid is true. A token that's for another app, from the other mode or past its end isn't valid.
The mode is the one you expect. With your live key you'll only ever see live sessions, but if your server keeps both keys, check mode.
Use playerId from Lia, never one the page sends.
Keep your key on your server. Never send it to the page, even for a moment.