What are Vivox Access Tokens (VATs), when are they required, and how do you generate them securely? This article explains VATs for authenticating privileged Vivox operations (sign-in, joining channels, kicking, server-wide mute/unmute, enabling transcription), their single-use and expiry behavior, and best practices to generate tokens on a secure server and deliver them to clients. It also points to sample VAT generation code in C++, C#, JavaScript, and Python for developers integrating Vivox.

Note: If you are using the Vivox Unity SDK, Unity Authentication tokens are the recommended way to manage players when channel access control is not required rather than Vivox Access Tokens. If you are using the Vivox Core SDK Vivox Unreal SDK, or special admin functions (muting a user for all other participants or kicking a user from a channel or server) Vivox Access Tokens are still required.

Scenario

Certain Vivox API calls require authentication to prevent user impersonation. This authentication system consists of objects known as Vivox Access Tokens (VATs).

Resolution

What are Vivox Access Tokens?

Player access to Vivox resources is controlled through Vivox Access Tokens (VATs). Vivox Access Tokens contain a payload that defines the privileged operation, are signed by the game server by using a token signing key, and are delivered by the client to the Vivox system when the player wants to perform a privileged operation. They are similar to JSON web tokens, but the access token header is empty.

Access Token Characteristics

Tokens can only be used once. When a token has been used for a privileged operation, it cannot be reused, even for the same operation.
Tokens expire even if they are never used. A token cannot be used after the expiration time that is set by the token issuer.

Privileged Operations

Signing in
Joining a channel (whether muted or unmuted)
Kicking a user from a channel or from the server
Muting or unmuting a user in a channel, for all other users in the channel
Enabling or disabling audio transcription (speech-to-text) in a channel

Before you release your game to production, you need to generate your access tokens on a secure server and then vend those access tokens to the game client. Allowing for token generation on the client during production is a security risk and can cause unexpected token expiration errors for your users.

Code Samples

Vivox provides ready-to-use VAT generation code for C++, C#, JavaScript, and Python. For code samples, see Where can I find the Vivox Access Token (VAT) generation code?

Related to