SDK

Invites and multiplayer

Who runs what

You run the multiplayer. Smaz Games does not host game servers, relay game traffic or provide matchmaking. Use your own servers or a service of your choice (for example a WebSocket server, a hosted game-server service, or WebRTC with your own signalling).

Smaz Games provides what is hard to do from inside a sandboxed game:

This is deliberate. Netcode depends on the game: a turn-based puzzle, a physics brawler and a 50-player arena need different servers. Running your own means you choose the region, tick rate and technology, and your game works the same on every site you publish it on.

How a multiplayer game fits together

1. The player opens your game. Your game calls init() and reads multiplayer.getRoomCode().
2. With no room code, the game shows its own lobby: create a room, quick match, or play solo.
3. Your game calls getPlayerToken() and connects to your server with the token.
4. Your server verifies the token and uses sub (the playerId) as the player's identity.
5. When a room is joinable, the game calls multiplayer.updateRoom({ room, joinable: true }). The site shows an Invite button.
6. A friend opens the invite link. The game starts with ?room=…, and your game joins that room.

const sdk = window.OpenArcade;

async function joinOnline() {
  await sdk.init();
  const invited = sdk.multiplayer.getRoomCode();
  const room = invited ?? sdk.multiplayer.createRoomCode();   // e.g. 'K7Q2PX'

  let token;
  try { ({ token } = await sdk.getPlayerToken()); }
  catch (e) {
    if (e.status === 401) return showGuestOptions();          // a guest: solo play or sign in
    throw e;
  }

  const ws = new WebSocket(`wss://play.example.com/rooms/${room}`);
  ws.onopen = () => ws.send(JSON.stringify({ type: 'hello', token }));
  ws.onmessage = event => handle(JSON.parse(event.data));

  sdk.multiplayer.updateRoom({ room, joinable: true });   // shows the Invite button
}

function onMatchStarted() {
  sdk.multiplayer.updateRoom({ joinable: false });        // hides it
}

Send the token in the first message rather than in the address, so it does not end up in server logs.

Invite links

You can add up to 5 parameters, for example { room: 'K7Q2PX', mode: 'duo' }. Names are up to 24 letters, numbers or _; values up to 64 letters, numbers, _ or -. Opening an invite link starts your game straight away. Invite links never contain player information; do not put any in the parameters.

Network rules

• List every server and service your game connects to under Outside addresses on the upload form, as wss:// or https:// origins. The browser blocks everything else. Plain ws:// and http:// are not allowed.
• WebRTC data channels work. List your signalling server; if you use TURN over TLS, list it as well.
• Use TLS certificates from a public certificate authority. Self-signed certificates fail.
• Allow cross-origin requests: uploaded games run on their own origin, which is not the site's address and can change. Do not rely on the Origin header to identify your game; verify the player token instead.
• Do not connect to servers that run other people's code or let players upload files.
• Changing the list of addresses needs a new version and review.

Latency and reliability

• Players connect from anywhere. Typical round trips are 50–150ms within a region and 200–350ms between continents. Use servers in more than one region, or design for the higher figure.
• Use client-side prediction and interpolation for real-time games. Do not trust the client for scores or results.
• When the site pauses the game (onHost with paused: true), the tab is hidden or the phone needs rotating, browsers slow down timers and animation frames. Keep the connection alive with a server-side timeout of at least 30 seconds, and resynchronise when the game resumes.
• Mobile networks drop. Reconnect automatically and let the player rejoin their room.
• If your servers are down, show a clear message and keep solo modes playable.

Chat and younger players

Smaz Games accounts are for people aged 13 and over, and guests can be any age. Players aged 13 to 17 have accounts, and you cannot see a player's age. These rules apply to every game with player-to-player communication:

• Free-text chat is allowed only when getSettings().disableChat is false, which means the player is a signed-in adult with a verified email. On your server, also check that the token's minor claim is false.
• For everyone else, including all guests, offer only preset messages (such as "Good game!" or "Ready") and emotes, or no chat.
• Filter all player text you display, including usernames, room names and team names, with a profanity filter.
• Provide in-game mute and report for every player, and act on reports.
• No private messages between players unless both are adults.
• No voice or video chat. The game frame does not have access to the microphone or camera.
• No links, images or files in chat.
• Declare Chat between players and, if players can name things or build levels, Content players create and share on the upload form.

Reviewers check chat for guests and for players under 18. A game whose chat ignores these rules is sent back.

Testing multiplayer

• In local test mode, open two browser windows with ?smazUser=test&room=TEST01. Tokens are fake (local-test-token); accept them only in development.
• Private previews use real tokens for your game, so you can test your production server before release. Previews run in the same sandbox as the published game.
• Include a short note in your game description if a mode needs other players online, and say what happens when nobody else is.