Foundations

Authentication

Every request to the /v1 surface is authenticated with a bearer API key, scoped to your tenant and to one of two environments.

Header

Authorization: Bearer bg_live_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

Prefix	Environment	Webhooks	Allowed modes	Notes
`bg_live_`	Production	Fires	`live`, `training`	Server-side only
`bg_test_`	Sandbox	Never fires	`test` only	Safe for CI/CD; rejected for live sessions

⚠

Never ship an API key into browser JS, a mobile bundle, or any client you don't control. The key is exchanged for a five-minute sessionToken server-side; only that token reaches the player's device.

Origin allowlist

Each key carries an allowedOrigins list. A request that carries an Origin header not on that list is rejected with 403 — with one exception: a bg_test_ key with no origins configured skips the check entirely, so local development never needs a placeholder origin.

Tenant configuration

{
  "allowedOrigins": [
    "https://yourapp.com",
    "https://staging.yourapp.com"
  ]
}

Session tokens

The sessionToken returned by session endpoints is a JWT with a 300-second (5 minute) expiry, carrying the session, tenant, game, mode, and player list. It is what your client passes to the embed SDK or socket layer — not the API key.

Beta Gamer GaaS API — questions? support@beta-gamer.com