Developer Tokens

Long-lived account tokens that authenticate management calls to the control plane.

A developer token authenticates an automated caller as your account. You present it in the X-Auth-Token header, and it can do anything you can do in the console, across all of your projects — configure games, manage pull secrets, publish versions, and more.

This is the credential for management operations. It is distinct from a project secret, which is scoped to a single project and is meant for deploy-only pipelines. A project token cannot perform management operations such as changing a game's settings.

All examples target the production control plane at https://control-plane.prod.620cloud.com.

Mint a token

Logging in through the console or CLI issues a token for interactive use. To mint one for automation, call the login endpoint with createDeveloperToken set to true. The response returns the token once — store it immediately (for example, as a CI secret).

curl -X POST "https://control-plane.prod.620cloud.com/accounts/login" \
  -H "Content-Type: application/json" \
  -d '{
    "email": "ci@acme.example",
    "password": "<password>",
    "createDeveloperToken": true
  }'

{
  "success": true,
  "developerToken": "<64-character-token>"
}

Only a one-way hash of the token is stored, so a lost token cannot be recovered — mint a new one and revoke the old.

Use a token

Send it as the X-Auth-Token header on management calls. For example, point a game at a custom container image:

curl -X PATCH "https://control-plane.prod.620cloud.com/projects/$PROJECT_ID" \
  -H "X-Auth-Token: $AUTH_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{ "customContainerUri": "ghcr.io/acme/my-game:1.4.2" }'

Revoke a token

Developer tokens do not expire on their own. Revoke one by logging out with the token in the X-Auth-Token header; any caller presenting it is immediately no longer authenticated. Revoke any token that might be exposed, and rotate by minting a new one before deleting the old.

curl -X POST "https://control-plane.prod.620cloud.com/accounts/logout" \
  -H "X-Auth-Token: $AUTH_TOKEN"

Developer tokens vs project secrets

See Project Secrets for the deploy-scoped token used by CI/CD pipelines.