Login With Xbox

Signs the user in using a Xbox Live Token, returning a session identifier that can subsequently be used for API calls which require an authenticated user

Error codes

This operation may return the following PlayFab errors:

Error	Code
EncryptionKeyMissing	1290
EvaluationModePlayerCountExceeded	1490
ExpiredXboxLiveToken	1189
InvalidXboxLiveToken	1188
RequestViewConstraintParamsNotAllowed	1303
SignedRequestNotAllowed	1302
XboxInaccessible	1339
XboxRejectedXSTSExchangeRequest	1343
XboxXASSExchangeFailure	1306

POST

Client

LoginWithXbox

curl --request POST \
  --url https://{titleId}.playfabapi.com/Client/LoginWithXbox \
  --header 'Content-Type: application/json' \
  --data '
{
  "XboxToken": "XBL3.0 x=1981989841;akljdlkafdknad",
  "CreateAccount": false,
  "TitleId": "144"
}
'

import requests

url = "https://{titleId}.playfabapi.com/Client/LoginWithXbox"

payload = {
    "XboxToken": "XBL3.0 x=1981989841;akljdlkafdknad",
    "CreateAccount": False,
    "TitleId": "144"
}
headers = {"Content-Type": "application/json"}

response = requests.post(url, json=payload, headers=headers)

print(response.text)

const options = {
  method: 'POST',
  headers: {'Content-Type': 'application/json'},
  body: JSON.stringify({
    XboxToken: 'XBL3.0 x=1981989841;akljdlkafdknad',
    CreateAccount: false,
    TitleId: '144'
  })
};

fetch('https://{titleId}.playfabapi.com/Client/LoginWithXbox', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://{titleId}.playfabapi.com/Client/LoginWithXbox",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "POST",
  CURLOPT_POSTFIELDS => json_encode([
    'XboxToken' => 'XBL3.0 x=1981989841;akljdlkafdknad',
    'CreateAccount' => false,
    'TitleId' => '144'
  ]),
  CURLOPT_HTTPHEADER => [
    "Content-Type: application/json"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "https://{titleId}.playfabapi.com/Client/LoginWithXbox"

	payload := strings.NewReader("{\n  \"XboxToken\": \"XBL3.0 x=1981989841;akljdlkafdknad\",\n  \"CreateAccount\": false,\n  \"TitleId\": \"144\"\n}")

	req, _ := http.NewRequest("POST", url, payload)

	req.Header.Add("Content-Type", "application/json")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

HttpResponse<String> response = Unirest.post("https://{titleId}.playfabapi.com/Client/LoginWithXbox")
  .header("Content-Type", "application/json")
  .body("{\n  \"XboxToken\": \"XBL3.0 x=1981989841;akljdlkafdknad\",\n  \"CreateAccount\": false,\n  \"TitleId\": \"144\"\n}")
  .asString();

require 'uri'
require 'net/http'

url = URI("https://{titleId}.playfabapi.com/Client/LoginWithXbox")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Post.new(url)
request["Content-Type"] = 'application/json'
request.body = "{\n  \"XboxToken\": \"XBL3.0 x=1981989841;akljdlkafdknad\",\n  \"CreateAccount\": false,\n  \"TitleId\": \"144\"\n}"

response = http.request(request)
puts response.read_body

{
  "code": 200,
  "status": "OK",
  "data": {
    "SessionTicket": "50DF92E291CCD4C3---A54F-8D3909FF54DEE10-B7817722BC94E536.A6DCCFE1C9709ABB",
    "PlayFabId": "50DF92E291CCD4C3"
  }
}

{
  "code": 123,
  "errorCode": 123,
  "status": "<string>",
  "error": "<string>",
  "errorMessage": "<string>",
  "errorDetails": {}
}

Body

application/json

If this is the first time a user has signed in with the Xbox Live account and CreateAccount is set to true, a new PlayFab account will be created and linked to the Xbox Live account. In this case, no email or username will be associated with the PlayFab account. Otherwise, if no PlayFab account is linked to the Xbox Live account, an error indicating this will be returned, so that the title can guide the user through creation of a PlayFab account.

TitleId

string

required

Unique identifier for the title, found in the Settings > Game Properties section of the PlayFab developer site when a title has been selected.

CreateAccount

boolean

Automatically create a PlayFab account if one is not currently linked to this ID.

CustomTags

object

The optional custom tags associated with the request (e.g. build number, external trace identifiers, etc.).

EncryptedRequest

string

Base64 encoded body that is encrypted with the Title's public RSA key.

InfoRequestParameters

object

Flags for which pieces of info to return for the user.

Show child attributes

Example:

{
  "GetUserAccountInfo": true,
  "GetUserVirtualCurrency": true,
  "GetUserData": true,
  "UserDataKeys": ["preferences", "progress"]
}

PlayerSecret

string

Player secret that is used to verify API request signatures.

XboxToken

string

Token provided by the Xbox Live SDK/XDK method GetTokenAndSignatureAsync("POST", "https://playfabapi.com/", "").

Response

code

integer

The Http status code. If X-ReportErrorAsSuccess header is set to true, this will report the actual http error code.

status

string

The Http status code as a string.

data

object

Show child attributes

Example:

{
  "SessionTicket": "50DF92E291CCD4C3---A54F-8D3909FF54DEE10-B7817722BC94E536.A6DCCFE1C9709ABB",
  "PlayFabId": "50DF92E291CCD4C3"
}

Last modified on October 1, 2026

⌘I

curl --request POST \
  --url https://{titleId}.playfabapi.com/Client/LoginWithXbox \
  --header 'Content-Type: application/json' \
  --data '
{
  "XboxToken": "XBL3.0 x=1981989841;akljdlkafdknad",
  "CreateAccount": false,
  "TitleId": "144"
}
'

import requests

url = "https://{titleId}.playfabapi.com/Client/LoginWithXbox"

payload = {
    "XboxToken": "XBL3.0 x=1981989841;akljdlkafdknad",
    "CreateAccount": False,
    "TitleId": "144"
}
headers = {"Content-Type": "application/json"}

response = requests.post(url, json=payload, headers=headers)

print(response.text)

const options = {
  method: 'POST',
  headers: {'Content-Type': 'application/json'},
  body: JSON.stringify({
    XboxToken: 'XBL3.0 x=1981989841;akljdlkafdknad',
    CreateAccount: false,
    TitleId: '144'
  })
};

fetch('https://{titleId}.playfabapi.com/Client/LoginWithXbox', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://{titleId}.playfabapi.com/Client/LoginWithXbox",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "POST",
  CURLOPT_POSTFIELDS => json_encode([
    'XboxToken' => 'XBL3.0 x=1981989841;akljdlkafdknad',
    'CreateAccount' => false,
    'TitleId' => '144'
  ]),
  CURLOPT_HTTPHEADER => [
    "Content-Type: application/json"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "https://{titleId}.playfabapi.com/Client/LoginWithXbox"

	payload := strings.NewReader("{\n  \"XboxToken\": \"XBL3.0 x=1981989841;akljdlkafdknad\",\n  \"CreateAccount\": false,\n  \"TitleId\": \"144\"\n}")

	req, _ := http.NewRequest("POST", url, payload)

	req.Header.Add("Content-Type", "application/json")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

HttpResponse<String> response = Unirest.post("https://{titleId}.playfabapi.com/Client/LoginWithXbox")
  .header("Content-Type", "application/json")
  .body("{\n  \"XboxToken\": \"XBL3.0 x=1981989841;akljdlkafdknad\",\n  \"CreateAccount\": false,\n  \"TitleId\": \"144\"\n}")
  .asString();

require 'uri'
require 'net/http'

url = URI("https://{titleId}.playfabapi.com/Client/LoginWithXbox")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Post.new(url)
request["Content-Type"] = 'application/json'
request.body = "{\n  \"XboxToken\": \"XBL3.0 x=1981989841;akljdlkafdknad\",\n  \"CreateAccount\": false,\n  \"TitleId\": \"144\"\n}"

response = http.request(request)
puts response.read_body

{
  "code": 200,
  "status": "OK",
  "data": {
    "SessionTicket": "50DF92E291CCD4C3---A54F-8D3909FF54DEE10-B7817722BC94E536.A6DCCFE1C9709ABB",
    "PlayFabId": "50DF92E291CCD4C3"
  }
}

{
  "code": 123,
  "errorCode": 123,
  "status": "<string>",
  "error": "<string>",
  "errorMessage": "<string>",
  "errorDetails": {}
}

PlayFab API

PlayFab REST API References

Login With Xbox

Error codes

Body

Response