Authentication

Every request to the Machine API must include a Bearer token in the Authorization header:

Authorization: Bearer sk_live_a1b2c3d4e5f6...

You obtain API keys from the operator dashboard at app.aggregator.gg/api-keys.

Key format

All operator API keys are prefixed sk_live_*. There is no separate sandbox or test key tier — your sk_live_* key is the same key you use for welcome-pack testing and for live customer traffic. See Environments & testing for how welcome credits make pre-launch testing safe.

Key rotation

Keys can be rotated with a 24-hour overlap window so you can deploy the new key before retiring the old one:

1. In the cabinet, click Rotate on the active key
2. A new sk_live_* key is generated; the old key is marked deprecated_at: <now>
3. Both keys are accepted for the next 24 hours
4. After 24h the old key is automatically revoked

We recommend rotating production keys every 90 days.

Rate limits

Default rate limits, evaluated in a 60-second sliding window:

Scope	Limit
All requests (per key)	600 / minute
All requests (per operator, sum across keys)	3 000 / minute
State-changing requests — POST / PUT / PATCH / DELETE — per key	200 / minute
State-changing requests — per operator	1 000 / minute
Failed authentication attempts per IP	100 / minute (brute-force protection)

State-changing requests count against both buckets (the all-requests one and the write-only one) so a flood of cheap GET /v1/games cannot exhaust the budget that legitimate POST /v1/sessions traffic needs.

Exceeded limits return 429 Too Many Requests with X-RateLimit-Limit, X-RateLimit-Remaining, and X-RateLimit-Reset headers. The X-RateLimit-Reset value is a Unix timestamp — wait until then, or use the Retry-After header on the response. The error body’s scope field tells you which bucket tripped (key, user, key_write, user_write) so you can adjust your request mix accordingly.

If your sustained POST /v1/sessions rate genuinely needs more than 200/minute, contact your account contact and we will raise the write bucket for your account.

Scopes

Each key grants access to its issuing operator’s resources within the operator’s configured permissions. Finer-grained scopes (read, write, admin) and per-key IP allowlists are on the roadmap — your account contact can let you know when they ship.

Security best practices

• Never commit keys to git. Use environment variables or a secret manager (1Password, Vault, AWS Secrets Manager).
• Never expose sk_live_* keys in browser-side code. This API is server-to-server only.
• Rotate on suspected compromise. Revoke the old key immediately if you believe it leaked.
• Use a dedicated rotated key for CI/integration tests rather than your production key. The cabinet lets you tag keys with names (e.g. prod-main, ci-runner) and revoke them independently.
• Treat welcome-pack traffic the same as paying traffic. The platform does not distinguish them in the API — and neither should your code.