Use your API key with confidence

Your API key is your application credential

API keys identify an integration when your backend communicates with protected Gaming API services. Generate keys from the developer dashboard and give each integration only the permissions it actually needs.

How to request data from the API

Use HTTPS from your trusted backend. The exact production hostname and endpoint paths must come from the deployed API contract; do not invent an endpoint based on this guide.

const response = await fetch(
  'https://YOUR-API-HOST/v1/resource',
  {
    method: 'GET',
    headers: {
      Authorization: `Bearer ${process.env.GAMING_API_KEY}`,
      Accept: 'application/json'
    }
  }
);

const data = await response.json();

GET, POST and parameterized requests

const response = await fetch('https://YOUR-API-HOST/v1/resource', {
  method: 'POST',
  headers: {
    Authorization: `Bearer ${process.env.GAMING_API_KEY}`,
    'Content-Type': 'application/json'
  },
  body: JSON.stringify({ example: true })
});

Understand what the server returns

Always inspect the HTTP status before processing a response as successful. A JSON body can contain useful error details even when the HTTP status indicates failure.

if (!response.ok) {
  throw new Error(`API request failed: ${response.status}`);
}

const data = await response.json();

Using live game updates

When the API exposes a production WebSocket gateway, use it for event-driven state updates rather than repeatedly polling an endpoint. Authentication and subscription rules must follow the deployed WebSocket contract.

const socket = new WebSocket(
  'wss://YOUR-API-HOST/realtime'
);

socket.onopen = () => console.log('connected');
socket.onmessage = event => {
  const message = JSON.parse(event.data);
  console.log(message);
};
socket.onclose = () => console.log('disconnected');

Errors, retries and idempotency

for (let attempt = 0; attempt < 3; attempt++) {
  try {
    // Make request here.
    break;
  } catch (error) {
    await new Promise(r =>
      setTimeout(r, 250 * 2 ** attempt)
    );
  }
}

Rate limits and efficient usage

Do not assume a fixed limit unless it is published by your actual API. Build clients that can handle a changing limit safely.

What your usage dashboard should show

The developer dashboard can provide a dedicated usage view for authenticated API activity. Useful metrics include request count, successful requests, errors, recent API access, active credentials and timestamps.

Measure API performance correctly

Latency shown by a browser health check measures the path from the user's browser to the public site. It is not the same as authenticated API latency. For real API performance, measure the actual API request from your backend and record status, duration and endpoint.

Protect every request