XMDT (Identity Verification)
XMDT is identity verification for copub games: full name, date of birth, phone number (OTP-verified), and consent. It is a separate, standalone SDK — alogame-kyc-sdk — not part of SDK v2 and not something you get by integrating v2.
Everything on this page and the pages under it describes the dev environment (api-xmdt.dev.alogame.vn). Production has not been provisioned yet — do not point a live build at it.
What it looks like
The SDK's own screen — a bottom sheet in portrait, a centered dialog in landscape. Identical on Android and iOS.
Why this exists
Player identity data (name, date of birth, phone) must never transit your game server. Copub game servers are self-hosted and outside Alogame's control, so there is no way to audit what a game server logs or retains. XMDT's entire design point is that this data goes device → Alogame directly, and your server's only involvement is one signed call that never carries any of it.
Who implements what
| Implements | Sees player PII? | |
|---|---|---|
| Your game server | One signed HTTP call to mint a session token — its response also tells you whether the player is already verified | No |
| Your game client (Android/iOS) | Three SDK calls: init, setGameRole, show | No — the SDK owns its own screen |
| Player's device | Everything else — the actual name/DOB/phone/OTP form | — |
Your client never talks to Alogame's identity API directly, and your server never sees a name, date of birth, phone number, or OTP code. Both sides only ever handle opaque tokens.
The flow
The last step is a UI signal, not proof: a modified client can report Success at will. Don't gate on it alone — at the actual point you need to trust the answer (letting a player into a match, for example), call POST /xmdt/session again and read xmdtCompleted from that response. It's the same HMAC-signed, server-to-server call either way; the field is authoritative because it comes straight from Alogame, never relayed through the player's device. See Server Integration.
Next steps
- Server Integration — the one call your server makes, both to mint a session and to check real verification status.
- Android — SDK install and the three-call integration.
- iOS — SDK install and the three-call integration.
- Unity — UPM package wrapping both native SDKs; no Gradle or Xcode editing.
- Cocos Creator — pure TypeScript, no native code at all; runs in the Editor without a device.
When to call show()
This is entirely your decision — the SDK does not enforce a gate and ekycx does not know or care when you call it. Common choices:
- At first login, before letting a new player into the game.
- Before a player's first purchase.
- From a settings/account menu, optionally.
Whichever you choose, the session your server mints tells the SDK whether the form is dismissible (xmdtRequired) — see Server Integration.