getSignedPlayerInfoAsync() for Facebook Instant Games, does it need to be called every request?

Question

The documentation mentions using FBInstant.player.getSignedPlayerInfoAsync() to get a signature when communicating with a custom backend.

https://developers.facebook.com/docs/games/instant-games/guides/bots-and-server-communication

Can I store the signature in a variable at the start of the app and then just use it throughout all the XMLHttpRequests for the current session?

Or do I need to call it everytime I make an XMLHttpRequest?

Answer 1

You are free to only call it once, however this will not allow you to validate the issued_at time, or to encrypt custom payloads.