User Verification
Updated: Aug 28, 2024
This is a Platform SDK feature requiring Data Use Checkup
To use this or any other Platform SDK feature, you must complete a Data Use Checkup (DUC). The DUC ensures that you comply with Developer Policies. It requires an administrator from your organization to certify that your use of user data aligns with platform guidelines. Until the app review team reviews and approves your DUC, platform features are only available for test users.User Verification validates the identity of each user accessing your application.
In addition to the basic Entitlement Check, this feature uses a client-provided nonce that is used by your trusted server to verify that the Meta account provided by the client is valid for the user providing it. This user verification does not replace the Entitlement Check.
Your application will call ovr_User_GetUserProof() to retrieve the nonce. Then after passing to your server, make a S2S call to verify that the user is who they claim to be.
Integrate User Verification
Minimal integration is required for User Verification, the only function you have to integrate is to retrieve the nonce. The end-to-end flow for User Verification can be found in the diagram above.
Generate nonce:
ovr_User_GetUserProof()
Validate Nonce (POST)
The next step requires to you send a S2S API request. See the
Server-to-Server API Basics page for information about interacting with our APIs.
You will send a POST request that contains a nonce and an Meta account to the
https://graph.oculus.com/user_nonce_validate endpoint to verify that the Meta account from the client is valid. See the
Overview page for more information on retrieving the Meta Quest account.
curl -d "access_token=OC|$APP_ID|$APP_SECRET"" -d "nonce=$NONCE" -d "user_id=$USER_ID" https://graph.oculus.com/user_nonce_validate
The request returns a verification of the nonce. For example:
Retrieve a Verified Org Scoped ID
Once you’ve used GetUserProof() and the S2S API to verify the Meta Quest account from the client is valid, you can then send a GET request specifying the User ID to retrieve an Org Scoped ID.
curl -d "access_token=OC|$APP_ID|$APP_SECRET" -d "fields=org_scoped_id" -G https://graph.oculus.com/userID
The request returns a verified Org Scoped ID:
Retrieve a Verified Organization Grouping Scoped ID
Similarly to retrieving a verified org scoped ID for a user in a single organization, you can retrieve a verified organization grouping scoped ID for a user across an organization grouping.
curl -d "access_token=OC|$APP_ID|$APP_SECRET" -d "fields=org_grouping_scoped_id" -G https://graph.oculus.com/userID
The request returns a verified organization group scoped ID:
{"org_grouping_scoped_id":"ID"}
