Getting the session token

Your game's client code runs inside the operator's iframe. Before it can do anything else, it needs the session token established at launch time — how your game reports its lifecycle back to the shell once it's running is a separate concern, covered in Reporting lifecycle events.

The session token is not delivered through GameBridge — that's a different mechanism entirely, and never carries the token itself.

Instead, the platform appends it as a ?session=<token> query parameter to the launchBaseURL your provider tenant registered, and the operator loads that full URL into the iframe. Your game page is static, so the token lands directly in the browser, on the iframe's own URL.

The expected pattern:

1. Your client reads session off location.search (e.g. new URLSearchParams(location.search).get('session')).
2. It sends the token to your own game backend.
3. Your backend validates it via ProviderClient#verifySession — this call requires your tenant's HMAC secret, which must stay server-side, so verification can never happen in the browser itself.