AppTokenResponse

A short-lived, app-scoped gameplay token (Overworld portal). Confined to a single app: usable only against that app's Game API + Buddy realtime surface (plus read-only me and same-app refreshAppToken). It CANNOT perform management operations and CANNOT mint tokens for other apps, so a game stack that receives it never gets the player's full identity session.

type AppTokenResponse {
  token: String!
  gameTokenId: String!
  appId: String!
  expiresAt: String!
  gameApiUrl: String
  gameApiWsUrl: String
  launchUrl: String
}

Fields

AppTokenResponse.token ● String! non-null scalar

Opaque app-scoped gameplay token. Send to the target app's Game API as Authorization: Bearer <token> (and in the realtime connectionParams). Do NOT send it to the Management API for anything other than me/refreshAppToken.

AppTokenResponse.gameTokenId ● String! non-null scalar

Identifier of the underlying game_token row, as a String.

AppTokenResponse.appId ● String! non-null scalar

The app this token is confined to, as a String.

AppTokenResponse.expiresAt ● String! non-null scalar

ISO-8601 UTC expiry. Call refreshAppToken (same app) before this, or re-portal through the Overworld for a different app.

AppTokenResponse.gameApiUrl ● String scalar

Base HTTPS URL of the Game API that serves this app (null if the app has no dedicated/shared game-api route yet).

AppTokenResponse.gameApiWsUrl ● String scalar

WebSocket URL of the Game API that serves this app (wss://), for realtime subscriptions.

AppTokenResponse.launchUrl ● String scalar

Browser launch URL for this app (where the player's browser plays it), if configured.

Returned By

exchangePortalCode mutation ● mintAppToken mutation ● refreshAppToken mutation