API Authentication

Secure API requests

All API requests require authentication using API tokens and player private keys. This ensures secure access to game data and player information.

Send your API token in the request header:

X-Api-Token: API_TOKEN

Send the player token for player-specific operations:

X-Game-Player-Token: PLAYER_TOKEN

Admin operations require your private API token. Never embed it in shipped clients:

X-Api-Private-Token: PRIVATE_TOKEN

Tokens are accepted via headers only — query parameters (api_token, player_token, private_token) are not accepted; tokens in URLs leak via logs and proxies.
WebSocket connections accept the realtime token via the X-Realtime-Token header (?token= remains as a fallback for platforms without header support).
Rate-limited endpoints return 429 with a Retry-After header.
Non-host players may only send room messages to the host.