Skip to main content

AppTokenResponse

A short-lived, app-scoped gameplay token (Overworld portal). Confined to a single app: usable only against that app's Game API + Buddy realtime surface (plus read-only me and same-app refreshAppToken). It CANNOT perform management operations and CANNOT mint tokens for other apps, so a game stack that receives it never gets the player's full identity session.

type AppTokenResponse {
  token: String!
  gameTokenId: String!
  appId: String!
  expiresAt: String!
  gameApiUrl: String
  gameApiWsUrl: String
  discoveryUrl: String
  launchUrl: String
  authorizedServer: ServerStatus
}

Fields​

AppTokenResponse.token ● String! non-null scalar​

Opaque app-scoped gameplay token. Send to the target app's Game API as Authorization: Bearer <token> (and in the realtime connectionParams). Do NOT send it to the Management API for anything other than me/refreshAppToken.

AppTokenResponse.gameTokenId ● String! non-null scalar​

Identifier of the underlying game_token row, as a String.

AppTokenResponse.appId ● String! non-null scalar​

The app this token is confined to, as a String.

AppTokenResponse.expiresAt ● String! non-null scalar​

ISO-8601 UTC expiry. Call refreshAppToken (same app) before this, or re-portal through the Overworld for a different app.

AppTokenResponse.gameApiUrl ● String scalar​

Base HTTPS URL of the Game API that serves this app — its OWN datacenter's endpoint when a placement exists, because that is where the app's shards are. Null if the app has no dedicated/shared game-api route yet. Use this for gameplay; use discoveryUrl to recover if it stops answering.

AppTokenResponse.gameApiWsUrl ● String scalar​

WebSocket URL of the Game API that serves this app (wss://), for realtime subscriptions.

AppTokenResponse.discoveryUrl ● String scalar​

Stable entry origin, resolving to every datacenter, that always reaches SOME healthy instance. Use it to re-discover endpoints when gameApiUrl stops answering: a token-holding client cannot re-mint, because that needs the identity session it does not have. Never a per-datacenter or per-instance address.

AppTokenResponse.launchUrl ● String scalar​

Browser launch URL for this app (where the player's browser plays it), if configured.

AppTokenResponse.authorizedServer ● ServerStatus object​

Set only by refreshAppToken when the caller passed currentServer: the Buddy the NEW token was just authorized on, which is the node the client is already connected to. When present, keep the existing UDP session and start signing datagrams with the new token; there is no need to call serverWithLeastClients. Null when the caller passed nothing, or when that node can no longer serve this app (gone, draining, Full, or not local to the app) -- then call serverWithLeastClients for a fresh placement, exactly as before.

Returned By​

exchangePortalCode mutation ● mintAppToken mutation ● refreshAppToken mutation