Cross-platform saves and cross-play

Play this lesson

One pilot, three screens

Kai plays Hyper Shards on our website at home, on a Steam Deck at a friend's house, and on a phone on the bus. Three platforms (places a game runs and is sold, like the web, Steam, Google Play or the App Store), one pilot.

Three words get mixed up all the time, so let's pin them down.

Quick check

A pilot on a phone and a pilot on Steam join the same Hyper Shards co-op match. Which word fits?

  1. Cross-play
  2. Cross-buy
  3. Cross-progression
Show the answer

Cross-play

Cross-play means players on different platforms play together. Cross-progression is your own progress following you, and cross-buy is one purchase unlocking the game on several platforms.

One account, many doors

Cross-progression needs the same account everywhere. In Firebase Authentication, one account can have several providers, the services a player signs in with. Google, Apple and email are built in, and linking adds one to the player's account (the Firebase logins lesson shows linkWithPopup). The UID, the player's user ID, stays the same, so players/UID opens everywhere.

Apple's guideline 4.8 adds a rule for iPhone apps: if the main login uses a service like Google Sign-In, also offer one that limits data to name and email, lets players hide their email, and doesn't track them for ads without consent. Sign in with Apple does all three.

Steam needs a side door

Steam isn't one of Firebase's built-in providers. So we build a side door with a custom token: a signed pass made by our own server that says "this player is UID k3P9...".

Bolt says: A custom token expires after one hour. It only has to last long enough to sign in.

Bug hunt

functions/steamLogin.js
exports.steamLogin = onCall(async (request) => {  const { ticket, steamId } = request.data;  const real = await steamSaysOk(ticket);  if (!real) {    throw new HttpsError("unauthenticated", "Bad");  }  const uid = await uidForSteam(steamId);  const token = await getAuth().createCustomToken(uid);  return { token };});

A cheater sends a real ticket from their own Steam account, plus Remy's SteamID, and gets into Remy's account. Which line is the bug?

  1. Line 3
  2. Line 4
  3. Line 7
  4. Line 8
Show the answer

Line 7

Line 7 trusts the SteamID the game sent. The ticket was checked, but nothing ties it to that SteamID. The fix: use the SteamID that Steam itself returns when it checks the ticket. Never trust the client.

Two devices, two saves

Linking can hit a snag. Remy played Garden Defense on a new tablet as an anonymous player and reached wave 9. Then Remy taps Sign in with Google, but that Google account already has a save at wave 12. Firebase refuses with auth/credential-already-in-use, because one sign-in can belong to only one account, and its guide says merging the data is the app's job.

The same clash happens when one account saves from two devices, like a tablet that played offline. The Concurrency lesson shows how the last write can quietly win. Our options:

Player message

#help, @sproutcaptain
Got to wave 14 on my tablet on a plane, no wifi. After landing I played one quick wave on my phone. Now both say wave 9! Did you delete my garden?

What should the team build so this can't happen again?

  1. Store a savedAt time with each save, and when two saves disagree, show both and let the player choose
  2. Always keep the phone's save, because phones are newer
  3. Turn off the offline cache, so nobody can play without signal
Show the answer

Store a savedAt time with each save, and when two saves disagree, show both and let the player choose

The phone still had the old garden loaded, and its save replaced the tablet's wave 14: last write wins. With a time on each save, the phone can check the cloud copy before writing, notice the clash and ask, instead of silently throwing wave 14 away.

Bought on one store, used on another

Cross-buy runs into store rules. Garden Defense sells gem packs through Google Play's and Apple's own payment systems (the How in-game purchases pay lesson in Stage 6). Can gems bought on Android turn up on an iPhone?

Apple's guideline 3.1.3(b), Multiplatform Services, says apps may let players use items bought on other platforms or a website, including consumables in multi-platform games, as long as those items can also be bought as in-app purchases inside the iPhone app. Google Play's Payments policy says in-game currency may only be used in the game it was bought for. Rules change, so you and a parent check the latest versions first.

Quick check

Under Apple's Multiplatform Services rule, the iPhone version of Garden Defense may let players spend gems they bought on Android, as long as it also sells those gem packs as in-app purchases.

Show the answer

True

Guideline 3.1.3(b) allows items bought on other platforms, consumables included, provided the same items are also available as in-app purchases in the iPhone app.

Fair cross-play

Cross-play puts different hands on the same game. In co-op Hyper Shards that's mostly fine, because pilots help each other. For competitive modes we match by input, or let players turn cross-play off. Consoles add their own rules for cross-play and accounts, shared with approved studios (the Consoles lesson in Stage 7).

Next: leaderboards, where pilots from every platform chase the same top 10.

Bolt says: Progress, play, purchases. Cross-progression, cross-play and cross-buy are three different promises, and each needs its own plan.

Fact-checked 9 October 2026