Authentication

The API knows three kinds of credentials. Every operation in the reference says which one it needs (x-gampeon-auth).

Kind	Header	Used by	Status
Session token	Authorization: Bearer <token>	The portal, your own scripts	Preview
Access token	Authorization: Bearer gpat_...	AI assistants, MCP clients, scripts	Preview
Server key	X-Server-Key: <key>	Game servers sending heartbeats	Preview

Session tokens

POST https://api.gampeon.com/v1/sessions
Content-Type: application/json

{ "email": "you@example.com", "password": "..." }

{ "token": "...", "expiresAt": 1767225600000 }

A session is valid for 30 days. DELETE /v1/sessions/current ends it. A session token has every right of your account: keep it out of chats, logs and repositories.

Login is limited to 5 failed attempts per email and 30 attempts per IP address in 15 minutes.

Access tokens

Access tokens are for programs that act for you, above all AI assistants. Unlike a session, an access token:

• has scopes: it can only do what you allowed, for example read projects or edit marketplace items;
• expires after 30 days by default (at most one year);
• shows up in AI activity with every action it took;
• can be revoked at any time.

Scopes

Scope	Allows
profile:read	Read your profile (without email address) and your studios
projects:read	Read your projects and the studios you belong to
projects:write	Create projects and edit their pages (no deleting)
marketplace:read	Read your marketplace items, including blocked versions
marketplace:write	Create marketplace items and edit their texts (no uploads, no prices)
servers:read	Read your registered servers (never their keys)

GET /v1/tokens/scopes returns the same list with the templates and limits. GET /v1/token works with every valid token, whatever its scopes, and returns the token’s own name, scopes and expiry; MCP clients use it to check a token. Each operation in the reference that a token may use names its scope in x-gampeon-token-scope.

Everything else is closed

A token works only on the operations that list a scope. On every other operation, public ones included, the API answers 403 token_not_allowed. If the token lacks the scope, it answers 403 insufficient_scope. That is how the API makes sure that no token can ever:

• change your password, email or profile settings, or log you out,
• create, list or revoke tokens,
• moderate, administer or see other people’s private data,
• buy, sell, pay or move GAMPEONS, or set prices,
• upload versions or confirm the rights statement,
• delete anything.

With a token, GET /v1/me does not include your email address.

Creating tokens

In the portal under Account → Access tokens, or with your session:

POST https://api.gampeon.com/v1/me/tokens
Authorization: Bearer <session token>
Content-Type: application/json

{ "name": "Claude Desktop", "scopes": ["profile:read", "projects:read", "projects:write"], "expiresInDays": 30 }

The answer contains token once. DELETE /v1/me/tokens/<id> revokes it immediately. You can have up to 20 active tokens. Every new token adds a notification to your account, so you notice if someone else created one.

Activity log

GET /v1/me/token-events lists what your tokens did in the last 90 days: route, result (allowed or denied with the reason), client, MCP tool, IP address and time. Request and response contents are never stored. Clients can name themselves with the headers X-Gampeon-Client and X-Gampeon-Tool; the GAMPEON MCP server does this.

Limits

120 requests per minute and 2000 per hour per token, on top of the limits of each operation.

Server keys

You get a server key once, when you register a server. It is only valid for the heartbeat of that one server.

Roles

Some operations need a role: moderator for reports and appeals, admin for platform administration. They are not available to normal accounts and never to access tokens.