PlayFab Integration: Photon + PlayFab Linking

Photon + PlayFab Linking connects your backend identity (PlayFabID) with your multiplayer identity (Photon UserID).
This ensures that every player in a Photon room is tied to a real PlayFab account, allowing your game to sync stats, cosmetics, bans, and progression securely.

This page explains how the linking works, why it’s required, and how VR fangames use it.

1. Why Photon Needs PlayFab

Photon by itself does not know:

• Who the player is

• What items they own

• Whether they are banned

• Their display name

• Their cosmetics

• Their stats

• Their permissions (staff, mod, etc.)

PlayFab provides all of this.

Linking the two systems ensures:

• Secure identity

• Consistent player data

• Proper moderation

• Cosmetic syncing

• Stat syncing

• Anti‑cheat validation

Without linking, players could spoof identities or bypass bans.

2. How Linking Works (High‑Level Flow)

Step 1 — Player logs into PlayFab

PlayFab returns:

• PlayFabID

• Session ticket

• Player profile

Step 2 — Game connects to Photon

Photon is told to use the PlayFabID as the Photon UserID.

Step 3 — Photon authenticates using PlayFab

Photon sends the PlayFab session ticket to PlayFab for verification.

Step 4 — PlayFab confirms identity

If valid:

• Photon accepts the connection

• Player joins rooms normally

If invalid:

• Photon rejects the connection

• Player cannot join multiplayer

Step 5 — Player enters a room

PhotonView.Owner now represents the correct PlayFabID.

3. What This Enables

A. Secure Cosmetics

Players can only equip cosmetics they actually own.

B. Moderation Enforcement

• Banned players cannot join rooms

• Muted players cannot use voice chat

• Restricted players cannot join public lobbies

C. Stat Syncing

Photon can update:

• Tags

• Wins

• Time played

• Event progress

D. Staff Tools

Photon can check:

• Staff flags

• Moderator permissions

• Special room access

E. Anti‑Cheat

Photon can verify:

• Player identity

• Room join legitimacy

• CloudScript‑validated actions

4. Photon Custom Properties + PlayFab

Photon Custom Properties are used to sync PlayFab data into rooms.

Common synced values:

• "playfabId"

• "displayName"

• "badge"

• "color"

• "staffLevel"

• "pag" (Player Age Group)

• "cosmeticLoadout"

These properties allow other players to see correct cosmetics and names.

5. Photon Room Properties + PlayFab

Room properties can store:

• Map name

• Game mode

• Event status

• Required version

• Staff‑only flags

• Max players

• Region restrictions

PlayFab Title Data can define these values globally.

6. CloudScript + Photon

CloudScript can be used to:

• Validate room creation

• Log match results

• Update stats after matches

• Enforce bans

• Sync event progress

• Validate shop purchases inside rooms

This keeps multiplayer secure.

7. Best Practices

• Always use PlayFabID as Photon UserID

• Never trust client‑side identity

• Validate Photon authentication with PlayFab session tickets

• Sync cosmetics through PlayFab, not locally

• Use CloudScript for secure stat updates

• Store room settings in Title Data

• Use Photon Custom Properties for cosmetic syncing

• Use Photon Room Properties for game mode settings

8. Why This Matters for VR Fangames

VR fangames rely heavily on:

• Cosmetics

• Multiplayer identity

• Moderation

• Progression

• Events

• Stats

All of these require PlayFab + Photon working together.

Without linking, your game becomes vulnerable to:

• Identity spoofing

• Cosmetic hacking

• Fake staff accounts

• Bypass bans

• Fake stats

• Exploiters joining rooms

Linking prevents all of this.