Authentication

#Getting a key

1. Sign in to the panel with a software owner account.
2. Link Telegram to the account. Calls from an account without Telegram are refused with telegram_required while Telegram sign-in is on.
3. Open Developers → API and copy the key. Rotating it there revokes the old one at once.
4. Store it only on your server. A key shipped inside a mod can be read by anyone.

#Sending the key

API v2 looks for the key in this order: the Authorization: Bearer header, then X-Api-Key, then the api_key body field. Use whichever fits your HTTP client.

curl -sS -X POST 'https://dev.mod.wtf/api/v2/action' \
  -H 'Authorization: Bearer YOUR_API_KEY' \
  -H 'Content-Type: application/json' \
  -d '{
    "method": "get-softs"
}'

curl -sS -X POST 'https://dev.mod.wtf/api/v2/action' \
  -H 'X-Api-Key: YOUR_API_KEY' \
  -H 'Content-Type: application/json' \
  -d '{
    "method": "get-softs"
}'

curl -sS -X POST 'https://dev.mod.wtf/api/v2/action' \
  -H 'Content-Type: application/json' \
  -d '{
    "api_key": "YOUR_API_KEY",
    "method": "get-softs"
}'

16 to 256 characters

Keys outside that length are refused before any lookup.

Software Owners only

API v2 refuses other roles with forbidden_level.

Connect

Connect never sees an API key. The mod sends the license key and its device id, nothing else.

#Auth errors

Repeated failures from one address are throttled too, see limits.