---
title: Player tokens
nav: Player tokens
order: 3
---
# Player tokens

A player token is how your game tells Appside who is buying, **without** a login screen and without Appside calling your server to authenticate. It's a compact JWS (JWT) signed by your backend with ES256 (P-256).

## Claims (all required unless marked)
| Claim | Value |
|---|---|
| `alg` (header) | `ES256` |
| `kid` (header) | id of a public key you uploaded in Studio → Integration |
| `iss` | your issuer string, exactly as configured |
| `aud` | `appside:store:<storeId>` |
| `tenant` | your store id |
| `player_id` | your stable player id (≤ 200 chars) |
| `nonce` | 16–128 chars `[A-Za-z0-9_-]`, unique per token |
| `exp` | ≤ 5 minutes after now |
| `iat`, `nbf` | optional |

## Rules Appside enforces
- **Single use:** the nonce is consumed atomically. Opening the same token twice fails with *Player assertion already used*.
- **Short-lived:** anything over 5 minutes is rejected.
- **Your keys only:** Appside accepts public JWKs only. Uploading a private key is refused.
- **Rotation:** upload the new public key next to the old one, switch your backend to the new `kid`, wait 5 minutes, then remove the old key.

## Never in the client
Signing keys stay on your backend. The app asks your backend for a fresh token each time it opens the store.