Authentication
Every request carries a project API key as a bearer token. The key decides which environment the request acts in, which is why no request body or query string names a project or an environment. There is no user behind a key, no login step and no token to refresh.
curl "https://api.gemifier.io/v1/points?playerId=player-42" \
-H "Authorization: Bearer gem_sbox_..."The header is Authorization and the prefix is Bearer . The prefix is matched without regard to
case and the key is trimmed, so surrounding whitespace is not an error. Nothing else is read: no
query-string key, no X-Api-Key header, no cookie.
Where a key comes from
Open API keys in the dashboard and create one. The Public API cannot create, list, rename or revoke a key.
The full value is shown once, when you create it. After that the list shows only the first eight
characters, such as gem_sbox_a1b2c3d4, so store the key before you close the dialog.
| Environment | Key | Length |
|---|---|---|
| Sandbox | gem_sbox_ followed by 64 lowercase hex characters | 73 characters |
| Live | gem_live_ followed by 64 lowercase hex characters | 73 characters |
One key, one environment
A key belongs to a single environment, not to a project and not to an organization. A request cannot act outside it.
That is what makes Sandbox safe to build against. An event that exists only in
Sandbox is an event.not_found under a live key, and a sandbox key that leaks can reach nothing
live.
A key is a server secret. It never belongs in a browser bundle, a mobile app, a game client, a public repository or a support ticket. Call the API from your own backend and let your client talk to that.
A live key also needs billing
A Live key is refused with 402 while the organization has no active billing
(billing_required), or after a failed payment and its grace period (billing_payment_overdue).
The refusal comes before the endpoint runs, so nothing is written.
Sandbox is never gated this way.
When a key leaks
Revoke it in the dashboard. Revoking takes effect at once and cannot be undone, and no operation swaps a key's value in place.
To replace one without downtime, create the new key first, deploy it, then revoke the old one. An environment can hold more than one key.