> **Can't find what you're looking for?** Use `search_docs` on the docs MCP server at `https://www.openfort.io/api/mcp` to find what you need.
>
> **Have feedback?** Use `submit_feedback` on the same MCP server.

# LootLocker auth

LootLocker provides backend services for game developers, including player management, leaderboards, and in-game economy tools.

Once LootLocker is registered as a provider, Openfort verifies the token issued by your LootLocker session and maps it to an Openfort user. Players keep the game account they already have, and an embedded wallet is created for that identity without a second login.

## Prerequisites

* A LootLocker game whose client already signs players in and holds a session token.
* An Openfort project and its publishable key (`pk_test_` for sandbox, `pk_live_` for live).

## Set up your provider

To set up LootLocker to authenticate users with Openfort, visit your [dashboard provider settings](https://dashboard.openfort.io/providers).

<img width="50%" height="50%" src="https://www.openfort.io/images/blog/lootlocker_auth_49c09f0ca8.png?updated_at=2023-11-30T11:02:05.677Z" alt="LootLocker provider configuration in Openfort dashboard" />

Unlike Firebase (project ID) or [AccelByte](https://www.openfort.io/docs/configuration/external-auth/accelbyte) (base URL, client ID, client secret), the LootLocker provider carries no credentials of its own: enabling it is the entire dashboard-side configuration. Enable it separately in each environment you ship to.

## Authenticate from your app

Configure `thirdPartyAuth` with `ThirdPartyOAuthProvider.LOOTLOCKER` and a `getAccessToken` callback that returns the player's current LootLocker token, or `null` when nobody is signed in.

:::code-group
```tsx [React]
import { OpenfortProvider, ThirdPartyOAuthProvider } from "@openfort/react"

<OpenfortProvider
  publishableKey="YOUR_OPENFORT_PUBLISHABLE_KEY"
  thirdPartyAuth={{
    provider: ThirdPartyOAuthProvider.LOOTLOCKER,
    getAccessToken: async () => (await getLootLockerSessionToken()) ?? null,
  }}
  walletConfig={{
    shieldPublishableKey: "YOUR_SHIELD_PUBLISHABLE_KEY",
    ethereum: { chainId: 84532 },
  }}
>
  {children}
</OpenfortProvider>
```

```ts [JavaScript]
import { Openfort, ThirdPartyOAuthProvider } from '@openfort/openfort-js'

const openfort = new Openfort({
  baseConfiguration: {
    publishableKey: "YOUR_OPENFORT_PUBLISHABLE_KEY",
  },
  thirdPartyAuth: {
    provider: ThirdPartyOAuthProvider.LOOTLOCKER,
    getAccessToken: async () => (await getLootLockerSessionToken()) ?? null,
  },
})
```
:::

After your LootLocker sign-in resolves, call `getAccessToken()` to exchange the provider token for an Openfort session, and sign the user out of Openfort when their LootLocker session ends. [React](https://www.openfort.io/docs/products/embedded-wallet/react/auth/third-party) and [JavaScript](https://www.openfort.io/docs/products/embedded-wallet/javascript/auth/external-auth) show the full state-sync loop; Unity passes the same token through [`LogInWithIdToken`](https://www.openfort.io/docs/products/embedded-wallet/unity/auth/third-party).

## Verify it worked

Send a LootLocker token to the third-party verification endpoint with your publishable key:

```bash
curl https://api.openfort.io/iam/v2/user/third_party \
  -H "Authorization: Bearer pk_test_..." \
  -H "Content-Type: application/json" \
  -d '{"provider":"lootlocker","token":"<lootlocker-token>"}'
```

A verified token returns the Openfort user it resolves to:

```json
{
  "id": "usr_***",
  "createdAt": 123456789,
  "email": "satoshi@openfort.io",
  "emailVerified": true,
  "isAnonymous": false
}
```

A `401` means the token was not accepted. Check that LootLocker is enabled in the same environment as the publishable key you sent, and that the token has not expired. See [Errors](https://www.openfort.io/docs/api-reference/errors) for the response format.

## Related

* [Using a third-party auth provider](https://www.openfort.io/docs/configuration/external-auth) — all supported providers and the custom-auth alternatives.
* [Third-party auth headers](https://www.openfort.io/docs/api-reference/authentication) — calling the REST API with `x-auth-provider: lootlocker` and `x-player-token`.
* [Pregenerate wallets](https://www.openfort.io/docs/products/embedded-wallet/server/pregenerate-wallets) — create wallets ahead of first login with `thirdPartyUserId` and `thirdPartyProvider`.