Core RPG handbook · Development build / version notes
Documentation / Tile Tick Core RPG
Authentication & Characters
Local username/password flow, character identity and production replacement boundaries.
On this page
The included authentication flow is designed to make the framework testable end-to-end. It is intentionally not positioned as a production MMO identity backend.
Current authentication mode#
| Mode | LocalUsernamePassword |
|---|---|
| Protocol version | 1 |
| Username | 1–12 characters |
| Password | 4–64 characters |
| Password storage | PBKDF2-HMAC-SHA256, 200,000 iterations |
| First login | Automatically creates one account and one character |
| Duplicate login policy | RejectNew |
| Rate limiting | Minimum one second between attempts and at most six attempts per 30 seconds per connection |
| Client persistence | Username may be remembered; password is not persisted |
Identity concepts#
AccountIdidentifies login/account ownership.CharacterIdidentifies persistent gameplay/save data.- The display username is public presentation state.
- Normalized usernames and password material remain server-side.
Authentication flow#
NetworkLoginService accepts a bounded login request, rejects stale/rate-limited/protocol-invalid requests, calls the authentication service, acquires a character/account lock, and asks NetworkPlayerSpawner to inject identity and authoritative services before spawning the player object.
Production replacement boundary#
Application.persistentDataPath/Accounts and uses in-memory locks that are local to one server process. Multi-character selection, password recovery, email verification, external identity providers, distributed locks, and cross-server sessions are not implemented.The useful framework seam is the separation between authentication contracts/identity and the gameplay character. A production backend can replace the repository/authentication boundary without moving password handling into gameplay systems.