> ## Documentation Index
> Fetch the complete documentation index at: https://docs.musterbox.org/llms.txt
> Use this file to discover all available pages before exploring further.

# Register a game

> Register your game in MusterBox and create a browser-safe, origin-scoped game key.

Before your game can open sessions it must exist in MusterBox with a valid
**Game SDK credential**.

## 1. Register the game

Register the game in the MusterBox console. Registration produces:

| Field                   | Purpose                                        |
| ----------------------- | ---------------------------------------------- |
| `gameId`                | Identifier passed to the SDK's `gameId` option |
| display name            | Shown in match contexts                        |
| `supportsDraws`         | Whether `DRAW` outcomes are allowed in play    |
| `matchParticipantRules` | How participants map to bracket slots          |

## 2. Create a Game SDK credential

A credential (the developer API key) produces the **game key** you pass to
the SDK. Key facts, verified from the platform contract:

* The raw key is sent as the **`x-game-key`** header on session and result
  calls.
* It is **public by design** — a browser build must be able to send it. The
  protection is **origin scoping**: the key is bound to the `allowedOrigins`
  configured on the credential.
* It is **scoped to a game and an environment** (`sandbox`, `staging`,
  `production`).
* Session issuance additionally requires the **`session` scope** — without it
  `openSession` is refused with `403`.
* Keep the raw value **out of public source code**. It is public at runtime,
  but only from the origins you allow.

Example lifecycle: `mbsk_sandbox_...` is a browser-safe sandbox credential.
The runtime strips the game key before it reaches the Wasm boundary on the
browser — it is never part of the Rust runtime config.

## 3. Configure the SDK

```ts theme={"dark"}
const box = await createMusterBox({
  gameId: "my-arena-game",
  gameKey: "mbsk_sandbox_...",
  environment: "sandbox",
  baseUrl: "https://sandbox-api.musterbox.dev/api/v1",
});
```

## 4. Publish the game

A session is only issued for **published** games. Publishing is required
before the SDK can open a match:

* unpublished game → `403` from `POST /game-sdk/{gameId}/sessions`
  ("Game is not published and cannot be launched via the SDK").

## Good hygiene

* Separate credentials per environment; never share a production key with
  sandbox builds.
* Rotate credentials from the platform if you suspect a key leaked; rotation
  keeps `allowedOrigins` in sync with your deployment.
* Treat the `gameKey` as an **origin and environment claim**, not a secret —
  your game server, not the browser, is the real authority.

Next: [Package & install](/guides/package-and-install).