Authentication
Colyseus authenticates clients on two surfaces: room joins (via an onAuth hook) and HTTP routes (via middleware). The official @colyseus/auth module powers both surfaces and pairs with @colyseus/database for a zero-config user store, automatic route mounting, and revocation-aware sessions.
Fastest setup: add a GameDatabase to defineServer and @colyseus/auth wires itself: user store, register/login routes, ban gating, and revocation-aware JWTs, all from one option. → Database → Authentication
Common scenarios
Verify JWTs and reject revoked sessions in your room’s onAuth hook. The database integration handles revocation automatically.
Gate any HTTP route behind a valid JWT with auth.middleware(), which works for both Express handlers and the typed createEndpoint HTTP routes.
Atomic ban with tokenVersion bump (existing JWTs rejected on the next room join), or call bumpTokenVersion() standalone for non-ban revocations like password change.
Implement @colyseus/auth’s backend callbacks against your own storage. The @colyseus/database integration is optional. Every flow works without it.
200+ OAuth providers (Discord, Google, X, …), anonymous registration, and forgot/reset password flows with customizable email templates.
Override specific hooks (e.g. add an invite-code check on registration) while keeping the rest of the database integration intact.
Typed client methods for register, sign-in (email/password, anonymous, OAuth), password reset, and sign-out. The auth token is sent automatically.
Next Steps
- Database - The zero-config user store behind
@colyseus/auth - Room Lifecycle → On Auth - The hook where room-join authentication runs
- Admin Panel - Inspect users and revoke sessions from a dashboard