Register a game

Register your game in MusterBox and create a browser-safe, origin-scoped game key.

Before your game can open sessions it must exist in MusterBox with a valid Game SDK credential.

1. Register the game

Register the game in the MusterBox console. Registration produces:

Field	Purpose
gameId	Identifier passed to the SDK’s gameId option
display name	Shown in match contexts
supportsDraws	Whether DRAW outcomes are allowed in play
matchParticipantRules	How participants map to bracket slots

2. Create a Game SDK credential

A credential (the developer API key) produces the game key you pass to the SDK. Key facts, verified from the platform contract:

• The raw key is sent as the x-game-key header on session and result calls.
• It is public by design — a browser build must be able to send it. The protection is origin scoping: the key is bound to the allowedOrigins configured on the credential.
• It is scoped to a game and an environment (sandbox, staging, production).
• Session issuance additionally requires the session scope — without it openSession is refused with 403.
• Keep the raw value out of public source code. It is public at runtime, but only from the origins you allow.

Example lifecycle: mbsk_sandbox_... is a browser-safe sandbox credential. The runtime strips the game key before it reaches the Wasm boundary on the browser — it is never part of the Rust runtime config.

3. Configure the SDK

const box = await createMusterBox({
  gameId: "my-arena-game",
  gameKey: "mbsk_sandbox_...",
  environment: "sandbox",
  baseUrl: "https://sandbox-api.musterbox.dev/api/v1",
});

4. Publish the game

A session is only issued for published games. Publishing is required before the SDK can open a match:

• unpublished game → 403 from POST /game-sdk/{gameId}/sessions (“Game is not published and cannot be launched via the SDK”).

Good hygiene

• Separate credentials per environment; never share a production key with sandbox builds.
• Rotate credentials from the platform if you suspect a key leaked; rotation keeps allowedOrigins in sync with your deployment.
• Treat the gameKey as an origin and environment claim, not a secret — your game server, not the browser, is the real authority.

Next: Package & install.