The top ownership level; it represents a team or a company. It hosts multiple games. Its management is in the Server section of the panel.
Game
The product under a studio. It has its own environments, modules, and API keys.
Environment
An isolated working copy of a game (for example development, live). Data is not shared between environments. Every API key and player session is bound to a single environment.
Environment domain
A domain bound to an environment; it is also used as the list of allowed origins (Origin) in browser requests.
Module
A product part that can be turned on and off: characters, economy, items, trading, store, rewards, social, chat, competition, notifications, webhooks, scenes, and plugins. The endpoints of a disabled module return 404 module_disabled.
Panel (admin panel)
The web interface where you manage the game. The panel API is separate from the player API and is outside the scope of this documentation.
A secret API key in the format crx_live_<prefix>_<secret>, kept only on your server. It can call all server endpoints. It is never put in the client or the game bundle.
Client key
An API key that can be embedded in the client. It cannot run sensitive commands (for example add_xp); however, on some endpoints there is no type gate, so use it only if it is really needed (endpoints).
Player session
The session created after the player signs in. It is carried with a cookie (__Secure-crx.session) or a Bearer session token and requires the x-crx-env header.
Access JWT
A short-lived token returned in the body when the session is opened, which your game server can verify offline with the JWKS. It is not the same thing as the session token.
JWKS
The public key set for verifying the access JWT (GET /v1/auth/jwks).
Guest
A player that needs no registration; it returns to the same player each time with the same secret value and can later be upgraded to an email account.
CSRF
Double submit that prevents the browser from sending unwanted requests on the user’s behalf: a cookie + the x-csrf-token header. Required on modifying requests in a cookie session.
Origin check
The rule that on modifying requests the Origin header must be one of the environment’s allowed origins. The server sends CORS headers only to origins in the same domain list; CORS is not authorization, this check runs separately.
Same origin
Serving the game and the API under the same domain (with a reverse proxy); architecture and hosting.
Realtime ticket
A single-use, 30-second identity token obtained to connect to the realtime socket (protocol).
A trusted package compiled into the server that offers game-specific commands, queries, and realtime modules (overview). Loading third-party plugins does not exist yet.
Command
A state-changing, durable, replay-safe operation.
Query
A read-only read.
Schema document (artifact)
The JSON document that describes all of a plugin’s operations and schemas (GET /v1/plugins/{id}/schema).
schemaSha256
The digest of the schemas section in the schema document; the version pinning key (bindings).
Binding
Typed client code generated from the schema document.
Pin
The record of which plugin and schema digest the client was built with; an upgrade_required error on a mismatch.
Access type (access)
The identity boundary of a plugin operation: player, server, or public.
Plugin state (grant state)
The plugin’s state in an environment: enabled, read-only, draining, disabled.
plugin-v1-decimal-int64
The encoding profile that carries plugin and realtime int64 values as decimal text (numbers and encoding).