How to build a safe API for Unity

Question

I want to build an API for Unity. I noticed many APIs in Unity like Vuforia, requires developers to generate a key on website, and then paste the key into Unity editor, I wonder how does it work? When will Unity send the key to website to validate? Which protocol is this so I can research more on the internet?

Answer 1

When will Unity send the key to website to validate?

It depends. Some send the key during every request. Some send the key once, then generate a temporary token that will be used to make other requests.

Which protocol is this so I can research more on the internet?

Most web API use the REST protocol.

Usually POST or GET request methods.

I wonder how does it work?

It's not complicated. You need to know C#, MySQL and PHP(any back-end language). If you know these 3 languages, you can do it.

The MySQL is used to store user information such as username, password. User can go on the website and create a private key. That key will be saved on the database and linked to that user with MySQL.

When you make a request from Unity(C#) to the server, you can get the key from the user then embed in a form(WWWForm). You can use that form (WWWForm.AddField("API_KEY", "Your key")) to make request to the server with the WWW or UnityWebRequest API.

When the PHP receives request from your Unity. You read the form sent from Unity with PHP ($_POST["API_KEY"]) and then check if the key is in the database with MySQL. If the key exist, go ahead and do what the request want. If the key does not exist in the database echo error message.

That's it. Below is an example of an API that converts Image to Text. It requires key to function. Some functions are not implemented and is only used to show how API key authentication is done.

C#:

public Texture2D texture;

public void sendData()
{
    string reqUrl = "http://yourServerUrl.com/app/imagetospeech.php";
    WWWForm reqForm = new WWWForm();

    //Add API key
    reqForm.AddField("API_KEY", "AEH392HEIQSKLZ82V4HCBZL093MD");
    //Add Image to convert to Text
    reqForm.AddBinaryData("REQ_IMAGE", texture.EncodeToPNG());
    WWW www = new WWW(reqUrl, reqForm);
    StartCoroutine(WaitForRequest(www));
}

private IEnumerator WaitForRequest(WWW www)
{
    yield return www;

    //Check if we failed to send
    if (string.IsNullOrEmpty(www.error))
    {
        UnityEngine.Debug.Log(www.text);
    }
}

PHP:

<?php

function keyExist($keyInput)
{
    //MySQL code to check if key is in the table
    //$retval = NOT IMPLEMENTED!
    if (!$retval) {
        return false;
    } else {
        return true;
    }
}

function convertImageToText($imageInput)
{
    //$retval = NOT IMPLEMENTED!
    if (!$retval) {
        return "";
    } else {
        return $retval;
    }
}

//Get API key from Unity
$apiKey = $_POST["API_KEY"];

//Check if API key exist
if (keyExist($apiKey)) {

    //Get the image from Unity
    $imageFile = $_FILES['REQ_IMAGE'];

    if (!empty($imageFile)) {
        //Success
        echo convertImageToText($imageFile);

    } else {
        echo "Failed!";
    }
}
?>