Dashboard guide
API keys
Every call to Scoreboat is made with an API key. A key is issued by you and holds a set of permissions, which decide which of your games and services it reaches and what it may do there.
API Keys in a game's menu shows the keys that reach that game; API Keys in the main side menu covers all your games, or multi-game keys.
Quick setup: a key for your game
Most games need just one key, and the Quick setup at the top of the page makes it in one click: Create a game key. It gets the Game client role on the game, which is what a shipped game needs and never covers settings or deletion, and it lasts until you revoke it, since a game already in players' hands cannot have its key swapped.
The window that shows the new key also gives the line that starts Scoreboat in a GameMaker game, ready to copy:
sb_init("<game id>", "<key prefix>", "<secret>");
Issuing a custom key
For your own server, a tool, or anything that needs more or less than the quick setup gives, open Custom key.
| Field | What it is for |
|---|---|
| Name, Description | For you: what uses the key. |
| Expiry date | When the key stops working. Tick Never expires for a key that lasts until you revoke it. |
| Authentication | Authentication keys can either be a Shared Secret which is a two-part key that you and Scoreboat both know and use to authenticate your client; or a Public Key: one half of a Ed25519 key pair that enables Scoreboat to authenticate you without needing to store a shared key. |
| Permissions | What the key may do. Tick actions in the tree, and the resulting permission strings are shown below it. |
After Issue key, the key's prefix and, for a shared-secret key, its secret are shown once. Copy them then: the secret cannot be shown again. If it is lost, issue a new key and revoke the old one.
Choosing permissions
Permissions name a resource and an action on it, such as "submit scores to this leaderboard". The tree offers:
- A single action on a single resource.
- Any rows, which grant the action on every resource of that kind under its parent: every leaderboard of the game, for instance.
- Everything below, which also covers resources you add later.
- The Game client role on a game, which grants exactly what a shipped game needs at runtime: reading and submitting scores, signing players in, using files as the folder rules allow, and joining rooms. It never covers settings or deletion, and services added to Scoreboat later join it automatically.
For a game build, issue a key with the Game client role on that game and nothing else. Anyone can take a key out of a game they have downloaded, so it must only allow what any player could do anyway.
For your own server, issue a separate key with what it needs, such as
submitting scores for any player, banning players, or the admin action on a
bucket, and keep it on the server.
The full list of resources, actions and what the role contains is on the Permissions page.
Revoking a key
Revoke stops a key at once. Tokens already issued from it stop working on their next call, and the key cannot be used to get new ones. Revoking cannot be undone.