Basic Game Setup

s&box Auth verifies that API requests come from real s&box players. It prevents identity spoofing and forged requests. This step is optional for development, but strongly recommended before publishing.

## Why Use Auth?

Without auth, anyone who knows your API key and a Steam ID can make requests as that player. With auth, every request is verified against Facepunch's servers to confirm the player's identity.

| Without Auth | With Auth |
|-------------|-----------|
| Requests are trusted as-is | Requests are verified via Facepunch |
| Anyone with the API key can make requests | Only real s&box players can make requests |
| Fine for prototyping | Required for production |

## Enable Auth

1. Go to your project on the [Network Storage dashboard](/tools/network-storage)
2. Open **Project Settings**
3. Toggle **s&box Auth** on
4. Click **Save**

That is it. Every request to this project now requires a valid auth token.

## How It Works in Your Code

**The library handles auth automatically.** When s&box Auth is enabled, the library calls `Services.Auth.GetToken("sbox-network-storage")` internally and attaches the token to every request. No code changes needed.

```csharp
// Auth is handled behind the scenes — same code with or without auth
var result = await NetworkStorage.CallEndpoint( "report-kill", new {
    target = "goblin"
} );
```

You do not need to generate tokens, pass Steam IDs, or modify your API calls. The library does it all.

## Skip Auth for Now

If you want to get your game working first and add auth later:

1. Leave **s&box Auth** disabled in project settings
2. Build and test your endpoints
3. Enable auth when you are ready to publish

Your game code does not change when you toggle auth on or off.

## Handling Auth Errors

If auth fails, the library returns `null` from `CallEndpoint`:

```csharp
var result = await NetworkStorage.CallEndpoint( "add-gold", new { amount = 100 } );

if ( !result.HasValue )
{
    // Could be auth failure, network error, or endpoint error
    // Check the s&box console for [NetworkStorage] log messages
    Log.Warning( "Request failed" );
    return;
}
```

The library logs detailed error information to the s&box console, including the error code (`SBOX_AUTH_FAILED`), the endpoint URL, and request details.

## Auth Readiness

```csharp
if ( await NetworkStorage.EnsureEndpointAuthAsync( "report-kill" ) )
{
    var result = await NetworkStorage.CallEndpoint( "report-kill", new { target = "training_dummy" } );
}
```

The library fetches single-use auth tokens internally and attaches them to each endpoint call.