Authentication & Identity

Every player has one HELIX identity. There is no per-world signup: when a player opens a world, they're already signed in (or they play instantly as a guest and can upgrade later). Your world never handles passwords — it receives a verified identity from the platform.

The launch flow

When a player opens a world, HELIX issues a short-lived Launch Ticket. Your client hands it to the SDK at init; the SDK validates it and exposes the player.

await Helix.init({
  worldId: window.HELIX_WORLD_ID,
  launchTicket: window.HELIX_LAUNCH_TICKET,
});

const user = await Helix.auth.getCurrentUser();
const me = await Helix.profile.getMyProfile();

FHelixInitParams Params;
Params.WorldId = WorldId;
Params.LaunchTicket = LaunchTicket;
UHelix::Get()->Init(Params);

UHelix::Get()->Auth()->GetCurrentUser(/* delegate */);

await Helix.init({ worldId, launchTicket });
const user = await Helix.auth.getCurrentUser();

Helix.init({ worldId = WorldId, launchTicket = LaunchTicket })
local user = Helix.auth.getCurrentUser()

When a player later joins a multiplayer instance, the platform issues a separate Instance Ticket that the runtime verifies before admitting them. You don't manage tickets by hand — the SDK and CLI wire them up.

Helix.auth

Helix.profile

Guests and virality

Guest play is a first-class path, not a fallback. A visitor who opens your link plays immediately as a guest; the platform surfaces a signup prompt at a natural moment (often with a small LIX incentive). Your code treats guests like any other player — they have an id, a profile, and a (stipend) wallet.

Permissions

A world declares the scopes it needs in its manifest — e.g. auth.profile, instance.join, network.events, social.friends. Players grant them on first launch. Request only what you use.

Reference

• Web SDK → Helix.auth / Helix.profile
• REST → GET /v1/me