Crux - Documentation
The interactive API explorer above requires JavaScript. Below is a JS-free index of the same specification, which is published at /openapi/v1.yaml.
SDK Quickstarts
- All SDKs index - Unity, Godot, JavaScript, Roblox. All MIT licensed.
- JavaScript:
npm install crux-sdk, then CruxClient.forPlayer(baseUrl, projectId, environmentId, apiKey), await crux.loginAnonymous(), await crux.setPlayerDocument(crux.playerId, "profile", value).
- Godot 4: copy the addon into
res://addons/crux/ and autoload it as Crux, then Crux.init_player(base_url, project_id, environment_id, api_key), await Crux.login_anonymous(), await Crux.set_player_document(player_id, "profile", value).
- Unity:
ServerToolkitClient.ForPlayer(baseUrl, projectId, environmentId, apiKey), await LoginAnonymousAsync(), await SetPlayerDocumentAsync(playerId, "profile", valueJson).
- Roblox (server-side):
Crux.init(projectId, serverToken, environmentId), then Crux:GetDataStore(name) or Crux:SubmitScore(...). Note that matchmaking is not usable from this SDK: the queue endpoints identify the player from the token, and this SDK authenticates as a server.
API Reference Sections
These are the sections in the published specification. Anything not listed here is not part of the documented HTTP API today.
- Player Auth - anonymous login, email register and login, token refresh, logout, guest upgrade, email verification, password reset, and Google / GitHub / Discord sign-in.
- Player Documents - per-player JSON documents by key, plus batch read and batch write. This is where saves and profiles live.
- Project Documents - environment-wide JSON shared by every player. Keys beginning
server: are readable only with a server token.
- Key Value - the same environment-scoped state under a key/value vocabulary. This is a naming facade over Project Documents, not separate storage:
/kv and /documents address the same data, versions and quotas, and server: keys stay server-token-only through either spelling.
- Shared Spaces - persistent JSON state a named set of players may read and write without you running a server. A space is the authorization boundary: a player who creates one owns it and manages its members, a server-created one is managed only by trusted credentials, and a non-member gets the same 404 as a space that does not exist. Documents inside a space keep the same versions, conflict rules and wait endpoint as player documents. Project documents are unaffected and stay server-authoritative.
- Stats - named integer counters the backend owns, per player. Reads are open to the player; writes need a server token.
- Achievements - a catalogue, optionally bound to a stat and a threshold. Bound achievements unlock in the same transaction as the stat write that earns them.
- Leaderboards - create boards, submit scores, read top pages, read a single player's standing, and read entries. Boards are addressable by UUID or by the key you gave them.
- Economy - currencies, virtual items, per-player balances and balance adjustments.
- Social - friends, pending requests and blocks.
- Notifications - in-app messages for the dashboard header bell. Unread by default, with dismissed items still readable under "show earlier". Read state is per user and server-side, so dismissing on one device clears the badge on another. Publishing is internal and HMAC-gated.
- Presence - who is in a channel right now, as a server-side lease rather than a document you maintain. The lease expires unless renewed, so a player whose client crashes or loses signal disappears on their own with no cleanup job. Join and heartbeat are the same call. Pair it with the document wait endpoint: presence answers who is here, wait answers when something changed.
- Matchmaking - queue by game mode and region, poll for a match, and report a match started or completed. A formed match is placed on a live server from your registry.
- Matchmaking Admin - dashboard-credential views over the live queue and formed matches: inspect and purge queue entries, inspect, cancel or force-form a match.
- Servers - register, heartbeat, deregister, and browse. Only servers with a current heartbeat are returned.
- Runtime - upload an immutable Godot 4 Linux dedicated-server build and request an EU session. Runtime execution is currently limited to the isolated Runtime Agent rollout.
- Live Config - versioned bundles, activated per environment.
- Generators - stored world-generator specs, rendered on demand. Renders are deterministic and never stored.
- Webhooks - outbound HTTPS callbacks. Register an endpoint per environment, pick events from the catalogue, and Crux POSTs signed JSON when they happen. Verify the
Crux-Signature HMAC, reject stale timestamps, and deduplicate on Crux-Delivery; redirects are not followed and the destination must be publicly reachable.
- Projects - projects and environments.
- API Keys - issue and revoke project API keys.
- Server Tokens - issue and revoke the tokens that authenticate trusted game servers.
- OAuth Providers - point Google, GitHub and Discord player sign-in at your own OAuth application instead of the shared one, and read back the exact callback URI to paste into it. The client secret is write-only: a read tells you whether one is stored, never what it is. Configuring it needs a signed-in dashboard session, so an API key cannot rotate a secret or switch off a login provider.
- Platform Auth - player identity that comes from a platform rather than OAuth. A Steam client passes a
GetAuthTicketForWebApi ticket, Crux verifies it with Valve from the server side and returns the usual access and refresh tokens, so the SteamID is one Valve confirmed rather than one the client claimed. An existing guest or email player can attach a SteamID instead of starting a second account. Your Steam publisher key is write-only and is configured per project from a dashboard session.
- Player Moderation - player status, bans and unbans.
- Project Admin - usage summary, audit log, and admin views over player data.
- Service - the unauthenticated health endpoint uptime monitors probe.
Operational Topics
- Pricing and free-tier limits: pricing page
- Data export and the no-strand commitment: guarantee
- Self-hosted vs managed: comparison guide. The SDKs and this specification are open source; the backend itself is operated by Supercraft and self-hosting is not available today.
Need a key? Sign up free - 10,000 monthly active players included on the free tier, every feature unlocked, no credit card.