Docs

Your game stays on your own HTTPS site. GameTok shows it in its feed, in a frame, and one script — bridge.js — lets it ask who's playing and report scores. Your server checks players with the GameTok API before trusting them.

How it fits together

Updates are instant: GameTok loads your hosted URL, so every time you deploy, players get the new version.

Quick start

1. Sign in at games.gametok.co/dashboard, choose your username and accept the Developer Agreement.
2. Add the bridge to your game's index.html:

   <script src="https://gametok.co/bridge.js"></script>

3. Allow GameTok to frame your page (see below) and deploy.
4. Try it as a draft: in the dashboard click + New Game, paste your URL and tick Save as a draft to test first. It opens in the private test player.
5. Go live: click Go live in the test player or on the game's page. If the automatic checks pass, it's in the feed at gametok.co/game/<id>.

Allow GameTok to show your game

GameTok shows your game inside a frame on https://gametok.co (and the test player on https://games.gametok.co). Your page must not send X-Frame-Options: DENY or SAMEORIGIN. If you send a Content-Security-Policy, include:

Content-Security-Policy: frame-ancestors 'self' https://gametok.co https://games.gametok.co

Examples

Players' browsers block http:// pages inside GameTok, so your game must be served over https://.

Publishing

Three ways, all ending in the same automatic checks:

• Dashboard: + New Game → your hosted URL, or upload a single self-contained index.html.
• API: POST /api/publish with an API key (see reference).
• AI agent: give Claude Code, Cursor or similar the prompt on the home page; it follows skill.md.

Publishing again with the same title updates your game. Re-check a live game any time from its Checks tab.

Test mode

Drafts are private: they aren't in the feed, search or your public profile, and their GameTok page isn't public. You play them in the test player (games.gametok.co/sandbox/?game=<id>) — the real GameTok player in TEST mode:

• GameTok.init() returns a test player (id t_…) and a test session.
• Every message between your game and GameTok is shown in a log.
• An integration checklist ticks itself: bridge loaded, player requested, session verified by your server, score submitted.
• Buttons send pause/resume so you can check your game handles them.

Make drafts with a test key (gtk_test_…) — anything it publishes is a draft and it can never change a live game — or with the dashboard's Save as a draft. When it works, click Go live.

Automatic checks

Every publish and Go live runs these. There's no manual review queue: the game goes live when every required check passes. You are still responsible for following the Developer Agreement.

If GameTok can't reach your URL at all (timeout, your host blocks bots), the game still publishes with a warning — open the GameTok link to make sure it plays.

bridge.js reference

Load it from https://gametok.co/bridge.js (never a copy: it gets fixes). Outside GameTok it stays dormant and your game works normally. Promise-returning calls reject with an Error that has a .code (see Error codes).

Player identity

Players are already signed in to GameTok, so your game doesn't need its own login.

const { player, session, mode } = await GameTok.init()
// player = { id: "p_3QmZ…", name: "Tolu", avatar: "https://…", guest: false }
// Send `session` to your server and verify it there before trusting `player`.

• player.id is a pseudonym for your game only. The same player always gets the same id in your game and a different one in every other game. Use it as your user id (progress, unlocks, saves).
• Guests: players who aren't signed in get guest: true, the name "Guest" and an id tied to their device.
• Never trust the browser. Anyone can edit game code. Your server must check the session:

POSThttps://gametok-backend-267787411422.us-central1.run.app/api/developer/sessions/verify
Authorization: Bearer gtk_live_…        (gtk_test_… in the test player)
{ "session": "<session from the game>" }

→ 200 { "valid": true, "gameId": "tap-tap", "mode": "live",
        "player": { "id": "p_3QmZ…", "name": "Tolu", "guest": false }, "expiresAt": "…" }
→ 401 { "valid": false, "code": "SESSION_EXPIRED" | "SESSION_INVALID" }
→ 403 { "valid": false, "code": "WRONG_GAME" | "WRONG_MODE" }

Full server example: sample/server.js.

Server API reference

Base URL https://gametok-backend-267787411422.us-central1.run.app/api. Authenticate with Authorization: Bearer <API key>. Keep keys on your server.

API keys

Create keys in Dashboard → Settings → API Keys. Each key is shown once; GameTok stores only a hash of the key. Revoke a key there at any time — it stops working immediately. Keys can't accept the Developer Agreement or create other keys; that needs you, signed in.

Error codes

Sample game

Tap Tap is a complete 40-line game using player identity, pause/resume and scores — view its source, copy it, and publish it as a draft to see the test player in action. sample/server.js is the matching Node server that verifies sessions.

Using an AI agent

Prefer to let an agent do it? Give Claude Code, Cursor or another coding agent this prompt from your game's folder. It follows skill.md and asks you for your API key.

Read https://games.gametok.co/skill.md and publish this game to GameTok. Ask me for my GameTok API key (games.gametok.co/dashboard → Settings → API Keys) before publishing.

Questions or problems: [email protected]