Drop-in login system for Unity 6 — 6 themes, 4 swappable backends (REST/Firebase/UGS/Mock), 8 languages, App Store-ready Privacy Manifest. Ship login in 2 minutes, not 2 weeks.OptiLogin renders via Unity UI Toolkit (UIDocument + Painter2D). It contains no shaders, materials, or mesh renderers — UI Toolkit's renderer sits on top of any pipeline. Works identically on Built-in, URP and HDRP with no configuration changes. Primary test target: URP. Switching pipelines requires no migration.The most complete login system on the Unity Asset Store.OptiLogin gives your Unity 6 game everything it needs to ship a polished, securesign-in experience — from the UI all the way down to a runnable ASP.NET Corereference server — without locking you into a single backend or making youwrite a single line of OAuth code.Perfect for any genre that needs player accounts: mobile RPGs, gacha titles,multiplayer competitive games, online card games, MMOs, casual & social apps.Anything that ships with a player profile.FULLY CUSTOMIZABLESix designer-grade themes (DarkSlate, LiquidGlass, NeonCyber, MinimalLight,MaterialYou, AuraGradient) driven by a single ScriptableObject. Drag a themeonto the controller to restyle every view — Login, Sign Up, Forgot Password —at once. Or create your own from scratch via Assets ▸ Create ▸ OptiLogin ▸Login Theme — every colour, gradient direction, corner radius, border width,font and social icon is a property. Live editor preview, no Play Mode required.Built on UI Toolkit, so every visual element is also customisable via UXML/USSif you want to push it further.FOUR PLUGGABLE BACKENDSAdd one component to choose: • Self-Hosted REST — full ASP.NET Core 8 reference server with PostgreSQL schema included • Firebase Authentication • Unity Gaming Services • Mock for prototypingBackends are interchangeable — the UI never knows which one is wired.OAUTH 2.0–GRADE SECURITY, BAKED IN • RFC 6749 §10.4 refresh-token reuse detection (revokes the lineage on attack) • AES-256-CBC + HMAC session storage with device-derived key • PBKDF2 600,000 iterations (OWASP 2024 guidance) • Per-account brute-force lockout with anti-enumeration response • Constant-time login closes the timing side-channel • JWT token versioning for instant logout-all • HTTPS enforced in release buildsBUILT FOR APP STORE GAMES, NOT WEB FORMS • Long-lived sessions that survive app restarts • Guest play with one-tap upgrade (preserves user id and progress) • Account deletion compliant with App Store Review Guideline §5.1.1(v) • Two-step "Delete Account" confirmation UI included • "Sign out everywhere" with token-version invalidation • Maintenance mode (503 with your custom message) • Bundled Apple PrivacyInfo.xcprivacy template — paste in, ship to App StoreEIGHT LANGUAGES OUT OF THE BOXEnglish, Traditional Chinese, Simplified Chinese, Japanese, Korean, German,Spanish and French — every UI label, error message and status pre-translated.Bundled Noto Sans CJK fonts (SIL OFL 1.1). Live locale switching andper-locale font swapping.TWO-MINUTE SETUPThe included Setup Wizard (Tools ▸ OptiLogin ▸ Setup) walks you through everystep: create the UI, pick a backend, test the connection live, pick a theme,add social providers, assign fonts, register scenes in Build Settings, openLocalization Settings. Reuses your previous answers across editor sessions.DROP-IN SOCIAL PROVIDER MODULESAdd the Google / Apple / Facebook / LINE component, the matching buttonappears. Your code provides the OAuth token via a single delegate; thebackend verifies it server-side. No secrets ever in your client build.PIPELINE & PLATFORM COMPATIBILITYOptiLogin renders entirely through UI Toolkit — no shaders, materials, or meshrenderers. Works identically on Built-in, URP and HDRP with zero migration whenswitching pipelines. Tested on Windows, macOS, iOS, Android and WebGL.DOCUMENTATION & SUPPORT • README + Server API + Game Integration docs (English / 繁體中文 / 日本語) • iOS & Android Platform Guide with a pre-submission checklist • OpenAPI 3.0 specification of the REST contract • Apple Privacy Manifest template ready to deploy • Runnable ASP.NET Core 8 reference server with full source (JWT, PBKDF2, EF Core, PostgreSQL schema, rotating refresh tokens, rate limiting) • EditMode unit tests (SecureStore, AuthValidator, AuthSession, Theme) • Discord community: discord.gg/se7EY2mpDG • Email support: hello@optiimind.comREQUIRED UNITY PACKAGES • com.unity.localization (1.4 or newer) • com.unity.inputsystem (1.7 or newer)The bundled Dependency Checker warns you on import if either is missing —a clear, actionable dialog instead of compile errors.LOGIN UI• UI Toolkit login panel — Sign In / Sign Up / Forgot Password / Reset Confirm views, driven by a single LoginPanelController• 6 designer-grade themes (DarkSlate, LiquidGlass, NeonCyber, MinimalLight, MaterialYou, AuraGradient) — ScriptableObject-driven, live editor preview• Custom GradientElement / GradientButton drawn with Painter2D (no shaders, no materials)• Form field icons (mail / lock / person) + password-reveal toggle (eye)• GravityGradientController — accelerometer-driven background motion• Drop-component social provider modules: Google / Apple / Facebook / LINEFOUR PLUGGABLE AUTH BACKENDS• Self-Hosted REST (no SDK required)• Firebase Authentication (gated by OPTILOGIN_FIREBASE define)• Unity Gaming Services (gated by OPTILOGIN_UGS define)• Mock backend for prototyping (auto-disables when a real backend is present)• Single shared AuthBackendBase: validation, busy state, status messages, automatic token refresh, session persistence• SocialTokenProvider delegate — your code supplies the provider OAuth token, the backend verifies it server-sideREFERENCE SERVER (ASP.NET Core 8)• Full runnable source — JWT, PBKDF2 hasher, fixed-window rate limiter• 12 endpoints: /auth/login, /register, /reset, /reset/confirm, /me, /refresh, /social, /guest, /upgrade, /logout, /logout-all, /delete, /health• PostgreSQL schema (001_init.sql + 002_add_login_lockout.sql)• EF Core stores for users, refresh tokens, password-reset tokens, devices and social identities — drop-in for InMemory• Maintenance-mode middleware (503 + custom message)• OpenAPI 3.0 specification + .http REST Client test fileOAUTH 2.0–GRADE SECURITY• AES-256-CBC + HMAC session storage with device-derived key• PBKDF2 600,000 iterations password hashing (OWASP 2024)• RFC 6749 §10.4 refresh-token reuse detection (revokes lineage on attack)• Per-account brute-force lockout (5 attempts / 15 minutes)• Constant-time login + constant-time password reset (timing-attack safe)• JWT token versioning for instant logout-all• HTTPS enforced in release builds; localhost exempted for dev• Anti-enumeration error messages on login, reset and lockout responsesGAME-SPECIFIC FLOWS• Long-lived sessions — refresh-on-launch, ~30-day refresh-token TTL• Guest play with one-tap upgrade (preserves userId and progress)• Account deletion with two-step confirmation UI — App Store §5.1.1(v) compliant• "Sign out everywhere" with token-version invalidation• Maintenance-mode message surfaces in the login panel• HomeScreen sample demonstrating the full post-login flowLOCALIZATION & FONTS• 8 languages out of the box: EN / 繁體中文 / 簡体中文 / 日本語 / 한국어 / Deutsch / Español / Français• Bundled Noto Sans CJK fonts: JP / TC / SC / KR — SIL OFL 1.1• Unity Localization integration with live locale switching• Per-locale font swapping; safe-fallback L10n.Get(key, fallback) helper• Optional — works with zero localisation setup (uses English fallbacks)EDITOR TOOLS• Setup Wizard (Tools ▸ OptiLogin ▸ Setup) — 7-step guided setup with live REST connection test and SDK auto-detection• Dependency Checker — actionable dialog when Localization / Input System is missing (instead of CS0246 wall of errors)• Custom Inspector for social providers — heuristic detects when you've pasted a secret where only the public id belongs• Theme preset generator (Tools ▸ OptiLogin ▸ Create Theme Presets)COMPATIBILITY• Unity 6.0+ (UI Toolkit Painter2D)• Render pipelines: Built-in / URP / HDRP — no shaders, zero migration• Platforms: Windows / macOS / Linux / iOS / Android / WebGL• Required Unity packages: com.unity.localization (1.4+), com.unity.inputsystem (1.7+)• .NET Standard 2.1; works with IL2CPP and ARM64 release buildsDOCUMENTATION & QUALITY• README + Server API + Game Integration guide — EN / 繁體中文 / 日本語• iOS & Android Platform Guide with 9-item pre-submission checklist• Apple Privacy Manifest template (PrivacyInfo.xcprivacy)• SECURITY.md coordinated disclosure policy (5-business-day SLA)• CHANGELOG following SemVer + Keep a Changelog• EditMode unit tests: SecureStore, AuthValidator, AuthSession, Theme• Discord community: discord.gg/se7EY2mpDG• Email support: hello@optiimind.comAI assistance (Claude Code) was used during development for:• Code review and architectural suggestions on the authentication backend, refresh-token rotation logic, and SecureStore encryption layer (the author authored, edited and tested all shipped code).• Drafting documentation and inline comments (README, ServerAPI, Game Integration, Platform-iOS-Android, CHANGELOG).• Drafting marketing copy on the Asset Store listing.No AI-generated art, audio, fonts or other binary assets are included.All code paths were reviewed and tested by the author. The reference ASP.NETCore server, themes, fonts (Noto Sans CJK under SIL OFL 1.1), icons andlogo are authored or licensed in the normal way.
