Authentication
Generate a game credential in Creator studio and store it only on your server. One credential covers server telemetry, achievement awards and verified scores; rotating it invalidates the old one for all three. Browsers never call these endpoints.
The grant_id and player_id come from the player's Peerless.runtime(), verified by your server through its normal connection.
Verify a player token
POST /api/play/provider/verify
Content-Type: application/json
{"token":"PLAYER_RUNTIME_TOKEN","gameId":"GAME_UUID","buildId":"BUILD_UUID"}Returns the game-scoped player and the trusted launch intent when the grant is still valid. The kit's verifyPeerlessProvider() wraps this call.
Confirm gameplay
POST /api/play/server-telemetry
Authorization: Bearer GAME_SERVER_CREDENTIAL
Content-Type: application/json
{"game_id":"GAME_UUID","grant_id":"CURRENT_GRANT_UUID","player_id":"GAME_SCOPED_PLAYER_UUID","action":"ready"}Award an achievement
POST /api/achievements/server-award
Authorization: Bearer GAME_SERVER_CREDENTIAL
Content-Type: application/json
{"game_id":"GAME_UUID","grant_id":"CURRENT_GRANT_UUID","player_id":"GAME_SCOPED_PLAYER_UUID","key":"first_victory","event_id":"RESULT_UUID","action":"unlock"}Send "action":"progress" with an absolute "value" for cumulative achievements.
Submit a verified score
POST /api/leaderboards/server-submit
Authorization: Bearer GAME_SERVER_CREDENTIAL
Content-Type: application/json
{"board_id":"BOARD_UUID","grant_id":"CURRENT_GRANT_UUID","player_id":"GAME_SCOPED_PLAYER_UUID","score":1200,"submission_id":"UNIQUE_RESULT_UUID"}Rules for every call
- Expired grants, foreign games or players and invalid credentials fail.
- Retrying with the same IDs and content is idempotent; the same ID with different content fails.
- Validate the result on your server before you submit it. A server credential proves who submitted, not that the result is real.