REST API: developer keys

Developer keys (agk_…) authenticate your server, not a player. They are scoped to one game (or all games for administrators) and to a set of permissions. Create them under Developers → Developer keys; your account needs the developer role.

Permission	Allows
`players:read`	`GET /dev/players/{id}` public profile
`playtime:read`	`GET /dev/players/{id}/entitlement`
`states:read`	list and read a player's save states for the game
`states:write`	save or delete them
`scores:read`	leaderboards, `GET /dev/games/{slug}/stats`
`scores:write`	submit scores on behalf of a player

Endpoints

GET  /api/v1/dev/players/{id}
GET  /api/v1/dev/players/{id}/entitlement
GET  /api/v1/dev/games/{slug}/players/{id}/states?include_state=1
PUT  /api/v1/dev/games/{slug}/players/{id}/states/{slot}      { state, label?, expected_version? }
POST /api/v1/dev/games/{slug}/players/{id}/scores             { score, board?, meta? }
GET  /api/v1/dev/games/{slug}/stats

The regular /games/{slug}/states… and /games/{slug}/scores endpoints also accept a developer key when you pass player_id.

Identifying the player on your server

Your game runs in the player's browser and knows the player's numeric id from ag.player.id. Send it to your backend together with the action; your backend then acts with the developer key. If you need a stronger guarantee that the request really comes from that player, have the game forward the player's agp_ token (create one with POST /me/tokens) and verify it on your server with GET /me.

Stats example

curl https://allgameclub.com/api/v1/dev/games/target-rush/stats -H "Authorization: Bearer agk_…"

{ "game": "target-rush", "plays_total": 1240, "playtime_hours_total": 86.5, "plays_30d": 410,
  "unique_players_30d": 96, "scores_30d": 388, "saved_states": 71, "top_scores": [ … ] }

Security

Keys are shown once and stored hashed. Revoke a leaked key immediately; create a new one.
Never ship a developer key inside game files; they are downloadable by every player.
Keys inherit the rate limit of 120 requests per minute (api.rate_limit_per_minute). Ask us if you need more.

Last updated October 11, 2026.