sc4pac [Guide] How to Setup Your sc4pac STEX Token

[Cyclone Boom 16,938]

Allowing Unlimited  downloads from the STEX

I'm pleased to formally announce a new greatly superior method to handle sc4pac authentication.

I've been working with @memo and @smf_16 to develop a system which allows downloading using his sc4pac tool, without restrictions from ST's end. Understandably STEX download limits are a barrier to sc4pac working efficiently, so we had to come up with a solution.

To surmise:

• As many of you will know, we maintain server integrity by placing limits on guest downloads (max of 20 per day and slower speeds).
• This means by default, downloading using sc4pac you're seen as a guest, with such restrictions implemented.
• Briefly there was a cookie authentication method to avoid that, but there were drawbacks in both security and ease of use.
• Now I've developed a Token system which will allow unlimited full speed downloading, while being secure and much simpler to implement.
• This means you can generate a personal token for your own use, to then input into sc4pac.

The token is a series of 64 random alphanumeric characters, which is unique to your own Simtropolis user account. Then whenever downloading using sc4pac, it sends the token to the ST server. I've implemented server-side logic which handles this, and looks up your token to make sure it's valid. Once accepted, sc4pac downloads from the STEX as a guest, but crucially bypasses the daily downloads limits and speed limitations.

 

How do I generate a Token for sc4pac use?

Please watch this video tutorial I've made which explains the process entirely...

 

Where is the Token page?

It's located at the following URL:
 https://community.simtropolis.com/sc4pac/my-token/

Note: You must be signed into your ST account in order to view this page. Only you can view your own token.

As explained in the video, there are options to generate a new token at any time, and revoke (delete) your current token. Doing so wipes out that token completely, which would require adding a new token into sc4pac in order to continue authentication.

Tokens once set do not automatically expire. You are free to continue using a given token for as long as you'd like.

By the way...
Please avoid posting your token in public, and also don't share it with anyone.  (We do keep track of usage.)

 

What is this "sc4pac" thing anyway?

Quite simply, sc4pac is a tool developed by @memo (and others) which allows you to automatically download and install SC4 custom content. The process from start to finish is fully automated, and allows you to select from an ever-growing list of sc4pac compatible plugins (more are being added). You'll notice a black "Install with sc4pac" button on many STEX files to download using sc4pac.

Of course, you'll have to first install the tool in order to benefit from this feature (it uses a local URL protocol).

The latest GUI version of sc4pac can be obtained from the STEX:

It comes available in 3 flavours depending on your system:
Windows, Linux, and a web-app version which runs in browser (cross-platform).

See the main sc4pac support thread for more info, and if you'd like help with using the tool itself.

 

So, what was wrong with the cookies authentication method?

Previously the only way around the daily downloads limit was to paste your ST session cookie data into sc4pac. Then the site would see you as downloading. You might be wondering why we don't continue with this.

The answer is while cookies worked, there were 3 main issues:

1) Security
As many of you will know, cookies are plain text data files containing information for a website to read. In this case, we're talking about ST login cookies. These allow you to remain signed into the site, after checking the "Remember Me" box. Previously sc4pac needed them to make sure ST knew you were downloading as yourself, not a guest. This way it worked around the daily downloads limitations.

While sc4pac remained secure, there's always a risk with handling one's session cookie data. There was at least one instance of someone posting their cookie data in a public reply seeking technical help, which was quite a concern. Anyone who obtained such info could sign into the member account the cookie belongs to. No password would be required, because a session cookie is the password. As such, it seemed far from ideal.

2) Ease of Use
Copying one's session cookies from browser inspector was a technical challenge. It was doable, but for some users who might not prefer to fiddle around with this sort of thing, it wasn't ideal. Also given it had to be copied into the exact format, there was risk of mistakes being made.

3) Convenience
After 3 months the cookies data would expire and need adding again. This would require you to go through the same steps to re-authenticate, because one's session cookies are only validated once signing into ST again. By using a token, this is now a moot point (since tokens don't expire).

To surmise visually:

So from the v1.1.0 update, sc4pac no longer supports cookie authentication.

The new tokens method fully supersedes the previous implementation. This means from now on, ST will download with guest permissions if the request doesn't have a sc4pac token. If you're still using the cookies authentication, we highly advise upgrading to the latest sc4pac version, generating your token, and adding it to your sc4pac instance. This is simpler to use, much more robust, and has no download restrictions.

 

What about my STEX downloads history?

When downloading using sc4pac with your token, it assigns downloads to your own account. This means you'll still appear in the Who downloaded this? lists for any file you're downloading. In effect you're downloading as a guest, but using your member permissions.

However, you still might want to lookup previous downloaded files and differentiate them from your regular STEX downloads.

Here's a preview of an upcoming site feature I'm creating which will do exactly that...

Concept Design Only (this is still under development)

As can be seen, there'll be a  indication icon for any sc4pac downloads (as I did for the NAM slope mod). It'll allow determining if there are newer versions of files, and ability to filter between those which have updates available. You'll also be able to see on STEX files themselves if you've download them before. This was a very helpful feature on the old LEX, which we'll finally be bringing to the STEX at long last.

The idea is a front-end preview which can help you navigate the STEX alongside sc4pac for managing your plugins.

I'll post further details once I finish developing the downloads history feature.

Please post below if...
You've any questions, comments, or feedback about sc4pac tokens or anything I've explained.

That means this topic is intended for replies about tokens. But no worries if asking about sc4pac we'll move posts to the correct thread.

(And thank you to @CorinaMarie for encouraging and providing me with moral support as ever!)

We hope collectively this gives you more freedom to use @memo's excellent tool.

[CorinaMarie 29,621]

This is a fantastic creation you've made and it'll really help peeps get up and rolling in their games. It is so much safer than using the Cookies thinger too.

[memo 1,446]

That's fantastic. Thanks for implementing all this and for the detailed documentation. I'm really looking forward to the new downloads history feature as well.

[Gunzerino 21]

One of the best things that ever happened to SimCity 4, if not the best thing. Thank you so much for making this 

[Cyclone Boom 16,938]

59 minutes ago, Gunzerino said:

One of the best things that ever happened to SimCity 4, if not the best thing. Thank you so much for making this 

Thanks ever so much for your comment too!

Now just to clarify so I'm not misleading anyone...

It's @memo who made sc4pac, which is indeed a fantastic program. In creating this guide, I had time to experiment with the tool for the first time, and I love how intuitive it is and easy to use. My role was to create the Token System which makes his tool integrate with ST (allowing unlimited STEX downloads).

[vetram 221]

1) i posted the following comment in sc4pac (Mod Manager)download page .....Trying to download it , but it stops downloading in 86.5 MB!..although the file size is 241.07 MB ...

2) I got this message from Norton antivirus ...is it all OK?

____________________________

Details

Threat name: IDP.Generic
Threat type: Miscellaneous - This is an app that you may have unknowingly installed and that may harm your computer performance.
Status: Threat detected
Detected by: Behavioral Protection
On PC from: 3/26/25, 11:33 AM
Last Used: 3/26/25, 1:08 PM
Startup Item: Yes

Very few
Very few in the Norton Community have used this file.

Mature
This file was released 17 days ago.

High
The file risk is high.
____________________________

Origin

Location: local://*PID 22184        
____________________________

Activity

Path | Type | Status
C:\Users\TONY\Downloads\SC4 Downloads\1. Official Maxis Files and Tools\sc4pac-gui-windows-x64\sc4pac-gui.exe | File | Infected
C:\Users\TONY\Downloads\SC4 Downloads\1. Official Maxis Files and Tools\sc4pac-gui-windows-x64\sc4pac-gui.exe | Process | Infected

[CorinaMarie 29,621]

3 hours ago, vetram said:

2) I got this message from Norton antivirus ...is it all OK?

Norton is notorious for false positives. They use the illogic that if something is not a commercial program and/or not seen very often then they tag it as a potential problem.

You can safely whitelist in this case.

[Christian_Knight78 44]

Talk about revolutionizing the download process. This saves time and energy. Outstanding work Corina and co.! 

[CorinaMarie 29,621]

10 hours ago, Christian_Knight78 said:

Outstanding work Corina and co.! 

While I appreciate the sentiment it's not me at all (other than some minor testing for CB).

In this thread it is @Cyclone Boom who created the token method on ST to integrate seamlessly with @memo's program.