brainCloud 6.1 is here! Epic Online Store, Xsolla Web Payments, Lua/LÖVE SDK, Improved Photon Integration, Security Improvements, and more!

Compatibility Notes

We prioritize preserving stability and backward compatibility for existing apps. App compatibility flags are located under App > Design > Core App Info > Advanced Settings; each is enabled to preserve existing behavior for existing apps, but disabled by default for new apps.

New compatibility flags in 6.1 [all default to enabled for existing apps]

• [x] Allow user delete and reset client callable (less secure, not recommended) - These calls already only allow a user to reset or delete themselves - but in the event that an account is compromised, it is safest to disallow the calls.
  It is highly recommended that devs disable this flag for their apps.
• [x] Return item definition image URLs in user item responses as stored, instead of the proper full paths returned from Item Catalog calls - this preserves a defect in how image URLs were not being properly qualified when returned from some of the User Item service calls. If your app doesn’t use the User Items service, or isn’t dependent upon the non-qualified URLs that were being returned, you can disable this flag… [or simply disable after adjusting your app].

Also note the following behavioral change:

• Settop handoff codes are now single-use. A code from CreateSettopHandoffCode() is used up the first time it is used toAuthenticateSettopHandoff(), so a client that retries needs a new code. Until now, a code could be reused until validSecs ran out.

Release Highlights

Epic Online Store

Bring your brainCloud-powered game to the Epic Games Store. brainCloud 6.1 adds integrated support for Epic authentication and in-app purchases - connecting Epic players and purchases to your game’s backend.

• Epic authentication — Let players sign in with their Epic Games accounts.
• In-app purchases — Support Epic Games Store purchases within your brainCloud-powered game.

Integrates with brainCloud Cash Products, Dynamic Pricing, Promotions, and LiveOps campaign features.

Note: The Epic Online Store integration does not support subscriptions.

Web Payments via Xsolla

brainCloud apps can now integrate web payments via the Pay Station feature of Xsolla.

This allows developers to reduce fees in some scenarios:

1. iOS (US) via Apple’s external link/buy button entitlement.
2. Google Play / Android (US) via out-of-app web links or integrated User Choice Billing.
3. Direct-to-consumer / Web / PC builds where platform store fees do not apply.

The integration works via the following APIs:

• Implements Xsolla’s In-Game Store / Store API
• Utilizes Xsolla Login to issue a JWT that identifies the brainCloud user
• Sends the user to the Pay Station checkout to purchase an IAP item
• brainCloud backend is notified of the payments via webhooks
• brainCloud automatically processes the purchase and awards the virtual currencies and/or items [like all of our AppStore integrations]
• brainCloud backend optionally consumes the Xsolla item or currency via the API
• brainCloud also supports the Refund API to reverse purchases as well [Refunds must be triggered via the Xsolla web console]

Note - this integration does NOT include support for:

• Xsolla Web Shops, which are full Xsolla storefronts showing multiple items for purchase. That support may come in future releases - once Xsolla makes a few additional dynamic hooks available - so that we can align the web shop offerings with brainCloud’s dynamic pricing / promotions / campaign controls.
• Subscriptions - does not currently support Xsolla’s subscription API

The Xsolla integration is configured via the new App > Design > Integrations > Payments screen.

Lua Client SDK (LÖVE / love2d)

brainCloud now has an official Lua client, built for the LÖVE game framework. The new Lua SDK covers the brainCloud client API: authentication, cloud data and entities, leaderboards, tournaments, items and virtual currency, lobbies and matchmaking, chat, presence, messaging, and more.

Highlights

• Works with LÖVE 11.4+ and LÖVE 12 on desktop (macOS, Windows and Linux), iOS, Android and the web. It also runs in plain LuaJIT / Lua 5.1 (with LuaSocket + LuaSec) for servers, tools and other Lua engines.
• Never blocks your game loop. Requests run in the background, and callbacks fire from bc:update(). Calls made in the same frame are bundled into a single request.
• Real-time support. Includes RTT for lobby, chat, presence, and event callbacks. Relay multiplayer works over UDP, TCP, or WebSocket, with reliable and ordered channels.
• Web builds. Games built with love.js run in the browser. The SDK sends HTTP and WebSocket traffic through the page automatically.
• Saved logins. Players keep the same profile across launches, and Smart Switch upgrades an anonymous player to a full account.
• Guided setup. The bundled setup tool signs you in to brainCloud in your browser. It then lets you pick or create an app and writes your config file for you. It also has a command-line mode for CI.
• Easy to install. Drop the braincloud/ folder into your game. It includes native networking libraries for each desktop platform.

To get started, download the SDK from the GitHub Releases page. For a full example, see CursorParty in lua-examples. It covers the whole flow from lobby to relay, plus chat and leaderboards.

Photon Multiplayer Integration

brainCloud has always supported Photon integration, but proper integration required a custom cloud code script.

This release handles that for you.

Go to the new App > Design > Integrations > Multiplayer screen to enable the integration.

Then, in the Photon Dashboard, choose to add a Custom Server Provider authentication, and fill in the following:

• Authentication URL - copy over from brainCloud
• Keys - set to “secret”
• Values - copy the Secret value from brainCloud

And voila - you’re good to go!

Security Improvements

The advent of AI has increased attacks on all kinds of online services, including gaming backends. We are working hard to keep pace with the changing threat environment and have added several improvements to brainCloud and its client libraries to help.

• App Secret Obfuscation - we upgraded the brainCloud client libraries to better hide the app secret packaged with them in your apps. We encourage all developers to upgrade to the 6.1 libraries and plug-ins to take advantage of these improvements.
• App Secret Rotation - we have also added the ability to rotate secrets on the server without immediately invalidating the old secrets. This lets you introduce a new secret while maintaining compatibility with apps still using the old secret for a period of time.
• Source IPs - we have surfaced the source IPs of incoming requests in more places in our portal. Note that for privacy reasons we are still not storing an end-user’s IP address long-term in the user’s account, but rather in the more temporary “login logs” that are surfaced in the user's browser. We also now track IPs in the Team audit logs and App security logs.
• Security Alerts - we have added a new App Alert to highlight security-related compatibility flags that are still enabled.

Miscellaneous Improvements

Other improvements in brainCloud 6.1 include:

• DataStream Event Filter - devs can choose to filter out certain events so that they are not stored locally and/or broadcast to external systems. This can be configured on the App > Design > Integrations > DataStream screen.
• Global Files - improvements to Folder Import process - including the ability to Add & Update instead of wholly replacing folders.
• i3D FlexMetal - improved support for geo matchmaking
• LiveOps Campaigns - new SYS API for creating and managing campaigns

Portal Changes

We continue to polish the Portal with every release. The following areas of the portal got some extra love for this release:

Application Dashboard

You will notice some handy changes to the dashboard page.

These changes include:

• New top-level widgets - for brainCloud Plan, DAU, Total Users, and API usage
• New Sessions widget - a new widget shows both API sessions and RTT sessions (if applicable) together
• New Links widget - with custom links to other services for your app. You could link to your app’s Steam page, marketing web page, iTunes Connect, etc. - whatever you’d like!

Application IDs re-org

We have reorganized and refactored the old Application IDs (App > Design > Core App Info > Application IDs) page. The data from that page is now spread across 3 new pages:

• App Details - in addition to editing an App’s name, the App > Design > Core App Info > App Details page allows developers to add a genre, description, notes, and even links to custom services ← which then become available from the app dashboard.
• App Secret - the app secret field has been moved to the App > Design > Core App Info > App Secret page, and now includes functions for rotating secrets.
• Platform IDs - device platform settings have moved to the Integration section: App > Design > Integrations > Platforms. That page includes all the previous platforms, plus the new Epic Online Services platform.

Integration Section re-org

We have reorganized and refactored the App > Design > Integrations section of the portal, splitting up the categories on the old Manage Integrations page into separate pages:

• Communications - with SendGrid and WebPurify
• DataStream - for all DataStream-related integrations
• Multiplayer - for multiplayer and hosting service integrations
• Payments - for web payments
• Platforms - the platforms section from the old Application IDs page
• Other - SAML and Slack

There were also changes to the following screens:

• App > Calendar - support for brainCloud Alerts and better previews of all calendar items
• App > Design > Core App Info > Advanced Settings, Compatibility Flags - can now filter by tags
• App > Design > Configuration Data, Import - we no longer allow imports to overwrite integrations or push notification certificates
• App > Design > Files > Global Files - improvements to the folder import process
• App > Design > Marketplace > Item Catalog - improvements to the Item / Bundle view and edit dialogs
• App > Design > Marketplace > Cash Products - added support for Xsolla Web Payments
• App > Global > Logs > Security - added the incoming IP address for security-related log entries
• App > Global > Marketplace > Transactions - added support for Xsolla web payments
• App > Reports > Analytics > Country - we added a tracker for our adopted shark, Ziggy, to the page. Note - you can turn it off - but then you won’t know if he’s around you when you are swimming!
• App > Reports > Analytics > Cash Product - improved labels for the charts
• App > Reports > Analytics > Store - support for the Epic Online Store and Xsolla Purchases
• User > User Browser
  • Added the Last Login IP for users who have visited in the past 30 days
  • Added support for browsing for Blocked (i.e., Locked Out) users via the [Browse] tab
• Team > Security > Audit Log - we now track the IP used for portal actions
• Team > Setup > AI Settings - added a bit more polish to the screen
• Team > Setup > Policies & Agreements - more polish for this screen as well

API Changes

The following changes/additions affect the brainCloud API:

• AppStore

  • Added two calls for retrieving information about a given store integration. Currently only works for Xsolla Web Payments:
    • GetStoreInfo() - retrieves ID information required to invoke a store purchase. Currently supported for Xsolla store only.
    • GetUserToken() - retrieves a store-specific user token to use to invoke a purchase. Currently supported in Xsolla store only.

• Authentication

  • AuthenticateEpicGames() - can be used to log into the game via an EOS account
  • SmartSwitchAuthenticateEpicGames() - added to the wrapper

• Campaign

  • New APIs for creating and managing LiveOps campaigns: SysCreateCampaign(), SysReadCampaign(), SysUpdateCampaign(), SysDeleteCampaign(), SysEnableCampaign(), SysCreateScenario(), SysReadScenario(), SysUpdateScenario(), SysDeleteScenario(), SysUpdateCampaignScenarioWeights(), SysGetCampaignPage(), SysGetCampaignPageOffset()
  • These management APIs are available via S2S and/or Cloud Code. Clients cannot call them directly.

• Identity

  • Additional Epic Games methods - AttachEpicGamesIdentity(), DetachEpicGamesIdentity(), MergeEpicGamesIdentity()

• UserItems

  • Added two new cloud-code-only calls for convenience: SysDropMyUserItems(), which takes a list of items to drop, and SysDropAllMyUserItems(). These calls make it much cheaper to drop multiple items, though they add an additional 1/10 API count charge per item.

Libraries and Examples

Client Libraries

All Libraries

• Setup plugin support (with app secret)
  • Parameterless Init() reads the config written by each SDK's setup plugin/tool, so you no longer need the app secret in code - which makes it easier for us to obscure
  • Child app profiles supported through init
• Epic Games (EOS) authentication support
• New AppStore APIs (Xsolla) - GetStoreInfo(), GetUserToken()
• AppStore docs updated for Epic Games, Xsolla, and Meta Horizon store IDs
• Entity / Custom Entity / Global Entity ACL is now optional; the server applies the default
• Monotonic Clock ticks within the RTT, Relay Server Comms layer

Unity, C#

• Additional Security and Plugin Updates
• Fixed region pings on .NET / Godot C# (HttpClient)
• Aligned Global Error Callback signature
• WebSocket SSL protocols defer to OS default

Godot (GDScript) - released 6.1.1

• Additional Security and Plugin Updates
• Single keep-alive HTTP connection for all requests
• Web export: improved config support, excludes unneeded binaries

Unreal

• Additional Security and Plugin Updates
• Added visionOS support
• Fixes for Android, UE 5.3, UE 5.8 / macOS 26 (class name collision)

Java

• Additional Security and Plugin Updates
• New Java Package to support JetBrains and Android Studio Plugin

JavaScript

• Additional Security and Plugin Updates
• Node 18+: New fetch-based comms layer with compression support
• npx Setup + VS Code task for Node projects
• Fixed relay socket leak across rounds

C++

• Added SmartSwitchAuthenticateApple

Objective-C

• Added the 6.1 api calls

Dart

• Additional Security and Plugin Updates
• Connection reuse: fixes timeouts and improves request performance

Roblox - Lua

• Additional Security and Plugin Updates
• Aligned to the 6.1.0 feature set and unit tests

Lua (LÖVE) - New

• New SDK braincloud-lua (LÖVE 11.4+/12, LuaJIT), soft beta at 6.1.0
• Desktop, iOS, Android, Web
• RTT, Relay (ws / tcp), Room Server, compression, auto-reconnect

S2S Libraries

• App secret obfuscated in logs (C#, Java, JS, Unreal)
• Reuse one open connection for requests instead of a new one each time (C++, JS)
• C++: CMake minimum lowered to 3.14 for older Ubuntu LTS
• Unreal: added SysUploadStream, GlobalFile tests runnable from bccm, fixes for newer Unreal versions
• GDScript S2S released at 6.1.0

Example / Demo Libraries

• All examples updated to 6.1.0
• Relay Test App (CursorParty)
  • RTT now stays connected for the whole session, so chat and leaderboards are more reliable
  • New chat panel, leaderboard, and end-of-match summary
  • Join-in-progress splotch/coverage sync, match results via cloud code
  • Unreal C++ RTA aligned to the other RTAs
  • New Lua / LÖVE RTA
  • RelayTestApp Viewer: GDScript S2S tool to view lobbies, members and chat
• BCChat - images, GIFs, URLs, YouTube links and emoji
• Unity - moved to 6000.0.79f1, notarized mac builds
• Dart - Spider Solitaire, Acey Deucy updates

Documentation and Tutorials

• All API additions and changes are documented at docs.braincloudservers.com.
• Documentation for the new LUA library has been added to the API Reference