Skip to main content

​
Key types

Send the developer API key as Authorization: ApiKey {key} — not as a bearer token. It works, for the games you own and within the permissions the key was created with, on:
  • reading your games, their versions, their Addressables state and their Editor Simulator configuration;
  • the analytics dashboard;
  • the build upload endpoints, and preview and share links for a build;
  • the Addressables upload, publish and rollback endpoints.
Developer API keys start with spdk_.

​
Rules

Game key goes in the client. Never put the developer API key inside game code — it has wider permissions than the game key. In Unity the game key lives in the PlatformConfig asset, created via SusaPlay → Setup. SusaPlaySDK.Initialize() reads it from there.
Never hardcode the key in a script. Anything compiled into a WebGL build is readable by anyone who opens the browser devtools, so treat the game key as public — it is scoped to a single game and grants nothing beyond it. Each game has one game key, and there is no separate staging environment for games. The SDK loads the config only from Assets/Resources/PlatformConfig.asset; an asset anywhere else is not found. To test before players see a build, keep the game private or use Preview and Share links.

​
Permissions

Each key holds only the permissions you choose when you create it. A request that needs a permission the key does not hold is refused with 403 and the code INSUFFICIENT_SCOPE. The response names the missing permission in requiredScope. When you create a key, pick a preset or choose the permissions yourself:
addressables:publish changes what players download on their next launch. Give it only to a key that must publish live.

​
Limits

Each key may make, per minute, 120 reads, 30 writes, 20 upload-URL requests and 10 analytics requests. Over a limit, the API answers 429 with the code RATE_LIMITED and a Retry-After header: wait that many seconds and retry. The Addressables batch endpoints sign up to 250 files a call, so a pipeline that uses them stays well within the limits.

​
Create a key

  1. Developer Portal → API Keys
  2. Click Create key
  3. Give the key a name that says where it is used, such as “GitHub Actions” or “Cursor — laptop”
  4. Pick a preset, or Custom to choose the permissions
  5. Click Create key and copy the key immediately — it is shown once
You can hold up to 10 active keys. Give each pipeline or tool its own key, so you can revoke one without breaking the others. Never commit a key to a repository, including a checked-in MCP or tool configuration file.

​
Revoke a key

In API Keys, click Revoke next to the key, then Revoke now. The key stops working on its next request, and revoking cannot be undone. To rotate a key, create a new one, update your pipeline or tool, then revoke the old one. Developer API keys created before October 2026 (starting with pk_) no longer work. Create a new key in their place. Partner keys, sent as Authorization: PartnerKey, are separate and keep working.

​
If a key is exposed

  1. Revoke it in the Developer Portal — the exposed key stops working at once
  2. Create a new key and update the secret in every pipeline and environment that used the old one