Skip to main content

​
Key types

Send the developer API key as Authorization: ApiKey {key} — not as a bearer token. It works on the build upload endpoints and on the Addressables upload and publish endpoints, scoped to the games you own.

​
Rules

Game key goes in the client. Never put the developer API key inside game code — it has wider permissions than the game key. In Unity the game key lives in the PlatformConfig asset, created via susaplay → Create Config Asset. SusaPlaySDK.Initialize() reads it from there.
Never hardcode the key in a script. Anything compiled into a WebGL build is readable by anyone who opens the browser devtools, so treat the game key as public — it is scoped to a single game and grants nothing beyond it. Separate production and test keys. Keep a separate PlatformConfig asset per environment and swap it at build time, so a test build can never talk to production:

​
Generate or rotate a key

  1. Developer Portal → your game → Settings → API Keys
  2. Click Generate New Key
  3. Copy immediately — shown once
After generating, update your build pipeline secrets before the old key is invalidated.

​
If a key is exposed

  1. Generate a new key immediately
  2. Update secrets in all environments (CI/CD, staging, production)
  3. Invalidate the old key from the API Keys page