Everything on the Unity page applies
The token model, the four ways into a match, the session routes, the fairness commitment, the wagering flow. Read the Unity page; this one is the differences.
Beyond the engine specifics: choosing a client credential is the same decision, hidden state is what the server refuses to tell the client, and shipping a turn-based game is the whole arc.
Godot
HTTPRequest is a node, so a long-lived client is usually an autoload singleton holding the tokens and one request node it reuses.
WebSocketPeer needs polling from _process. That is fine — the polling is yours, in the engine, not a tick on the server. The Durable Object on the other end hibernates between your messages regardless.
Store credentials with the platform’s own facility. user:// is not a secure store; on mobile that means the Keychain or the Android keystore through a plugin.
Unreal
The HTTP module is asynchronous and callback-based. Wrap the rotate-on-401 flow once, centrally — a retry policy scattered across call sites is how a client ends up rotating twice concurrently, which past the 30-second grace window revokes the whole token family.
Blueprint exposure is yours to design. The API has no opinion.
The one rule that matters more than the engine
The client is never the authority.
A score, a rating outcome, a game result and a random draw are all server-side. A submission body carries a score and nothing else; a session’s moves are validated by a model running in a Durable Object; dice come from a seeded stream the server advances and persists.
That is not a limitation of these engines’ integration. It is the design, and it is what lets one board serve iOS, Android and web without turning off the anti-cheat you adopted it for.
Hidden state
GET /multiplayer/sessions/:id returns your redacted view.
There is no route that returns the raw state, so an engine client cannot read an opponent’s hand however it asks.
Atomic simultaneous resolution means a trusted server collects every hidden submission and resolves them together — there is no instant at which one is committed and the other is still changeable.
Deep links and sign-in
A code is usually better than a magic link on a game client, because a link opening in an external browser has to get back into your app.
Six digits, five minutes, single-use.