Authentication

In order to use the features of the Chat SDK in your client apps, a SendbirdChat class should be initiated in each client app through user authentication with the Sendbird server. The instance communicates and interacts with the server based on the authenticated user account and is allowed to use the Chat SDK's features. This page explains how to authenticate your user with the server.

To use our chat features, you must initialize a SendbirdChat class by passing your Sendbird application's Application ID as an argument to a parameter of the Init() method of SendbirdChat.

SendbirdChat.Init(new SbInitParams(APP_ID));

By default, the Sendbird server authenticates a user with just a unique user ID. Then, the server queries the database to check for a match upon connection request. If no matching user ID is found, the server creates a new user account with a user ID. The user ID should be unique within a Sendbird application to be distinguishable from other identifiers such as a hashed email address or a phone number in your service.

While authenticating with just the user ID is convenient in the developing and testing stages of a service, a more secure authentication process using tokens is strongly recommended for most production environments.

Note: Go to the event handler page to learn more about the usages of the Chat SDK's handlers and callbacks.

// USER_ID below should be unique to your Sendbird application.
SendbirdChat.Connect(USER_ID, (inUser, inError) =>
{
    if (inError != null)
    {
        return; // Handle error.
    }
    // The user is connected to the Sendbird server.
});

Note: Apart from initializing the SendbirdChat class, you should connect to the Sendbird server before calling almost every method through the Chat SDK. If you attempt to call a method without connecting, ConnectionRequired is returned.

For a more secure way of authenticating a user, you can require authentication with either an access token or a session token along with a user ID.

Using Chat Platform API, you can create a user with their own access token or issue an access token for an existing user. Once an access token is issued, a user is required to provide the access token when logging in to the Sendbird application.

1. Using the Chat Platform API, create a Sendbird user account with information submitted when a user signs up or logs in to your service.

2. Save the user ID along with the issued access token to your securely managed persistent storage.

3. When the user attempts to log in to the application, load the user ID and access token from the storage, and then pass them to the Connect() method.

4. Periodically replacing the user's access token is recommended to protect the account.

Note: From Settings > Application > Security > Access token permission setting on your dashboard, you're able to prevent users without an access token from logging in to your Sendbird application or restrict their access to read and write messages.

// USER_ID below should be unique to your Sendbird application.
SendbirdChat.Connect(USER_ID, AUTH_TOKEN, (inUser, inError) =>
{
    if (inError != null)
        return; //Handle error.

    // The user is connected to the Sendbird server.
});

You can also use a session token instead of an access token to authenticate a user. Session tokens are a more secure option because they expire after a certain period whereas access tokens don't. See Chat Platform API guides for further explanation about the difference between access token and session token, how to issue a session token, and how to revoke all session tokens.

When a user is authenticated with a session token, the Chat SDK connects the user to the Sendbird server and can send data requests to the server for ten minutes as long as the session token hasn't expired or hasn't been revoked.

Upon the user's session expiration, the Chat SDK will refresh the session internally using the SbSessionHandler class. However, if the session token has expired or has been revoked, the Chat SDK can't do so. In that case, the client app needs to implement a SbSessionHandler instance to refresh the token and pass it back to the SDK so that it can refresh the session again.

Note: A SbSessionHandler instance must be set before the server connection is requested.

The following code shows how to implement the handler methods.

abstract class SbSessionHandler
{
public abstract void OnSessionTokenRequired(ISbSessionTokenRequester inSessionTokenRequester);

    public abstract void OnSessionClosed();

    public virtual void OnSessionError(SbError inError) { }

    public virtual void OnSessionRefreshed() { }
}

Because SbSessionHandler is a base class used to notify any event regarding the user's session and session token, you can register more events through SendbirdChat.SetSessionHandler(). See an example in the following code below.

/// A handler required on refreshing the session key on expiration.
/// This should be added by [SendbirdChat.SetSessionHandler] before the connection.
class MySessionHandler : SbSessionHandler
{
    public override void OnSessionTokenRequired(ISbSessionTokenRequester inSessionTokenRequester)
    {
        // A new session token is required in the SDK to refresh the session.
        // Refresh the session token and pass it onto the SDK through resolve(NEW_TOKEN).
        // If you don't want to refresh the session, pass on a null value through resolve(null).
        // If any error occurs while refreshing the token, let the SDK know about it through reject(error).
    }

    public override void OnSessionClosed()
    {
        // The session refresh has been denied from the app.
        // The client app should guide the user to a login page to log in again.
    }

    public override void OnSessionError(SbError inError)
    {
        // OPTIONAL. No action is required.
        // This is called when an error occurs during the session refresh.
    }

    public override void OnSessionRefreshed()
    {
        // OPTIONAL. No action is required.
        // This is called when the session is refreshed.
    }
}

A user can be disconnected from the Sendbird server when they no longer need to receive messages. However, the user will still receive push notifications for new messages from group channels they've joined.

When disconnected, all event handlers in a user's client app registered by the SendbirdChat.OpenChannel.AddOpenChannelHandler(), SendbirdChat.GroupChannel.AddGroupChannelHandler() or SendbirdChat.AddConnectionHandler() method stop receiving event callbacks from the server. Then, all internally cached data in the client app, such as the channels that are cached when SendbirdChat.OpenChannel.GetChannel() or SendbirdChat.GroupChannel.GetChannel() is called, are also flushed.

SendbirdChat.Disconnect(() =>
{
    // The current user is disconnected from the Sendbird server.
});