API keys

eaw_live_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

Send it in the header — never in a URL, query string or Discord message. Requests carrying?api_key= are rejected with 400.

Authorization: Bearer eaw_live_xxxxxxxxxxxxxxxxx

A key only grants what you tick. Requests outside a key's scopes return403 insufficient_scope.

• public.read — Read anything already public in the game world.
• nation.read — Read the key owner's own nation record.
• resources.read — Read the key owner's own resource reserves.
• military.read — Read the key owner's own forces and commanders.
• wars.read — Read wars and battle logs.
• market.read — Read market data when the market system ships.
• alliance.read — Read public alliance profiles.
• alliance.members.read — Read public alliance rosters.
• alliance.wars.read — Read wars involving an alliance.
• alliance.treasury.read — Read the key owner's own financial history.
• notifications.read — Read the key owner's own notifications.

• Revoking takes effect on the very next request — there is no cache to wait out.
• Rotate by creating a new key, deploying it, then revoking the old one.
• Creation date, last-used date and lifetime request count are shown for every key.

• Launch nuclear or strategic weapons
• Declare or resolve wars
• Transfer Credits or resources
• Withdraw from an alliance treasury
• Perform espionage
• Accept or sign treaties
• Modify alliance permissions or ranks
• Delete accounts or nations
• Any irreversible strategic action

Players are never asked for their Economics and War password by a third-party application. Planned OAuth authorization will show an explicit consent screen with AUTHORIZE / DENY.