# MusterBox Developer Docs

> Developer documentation for MusterBox — connect games to player identity, tournaments, match sessions, and secure purchases through the MusterBox SDK.

- [Build connected gaming experiences with MusterBox](https://docs.musterbox.org/index.md): The MusterBox developer platform connects games to player identity, tournaments, match sessions, and secure purchases — from a single, engine-native SDK.
- [Quickstart](https://docs.musterbox.org/getting-started/quickstart.md): Connect a game to MusterBox end to end — register the game, install the SDK, open a session, and report a result.
- [Overview](https://docs.musterbox.org/getting-started/overview.md): How the MusterBox platform, SDK, and public API fit together.
- [Architecture](https://docs.musterbox.org/getting-started/architecture.md): The request flows, security boundaries, and lifecycle behind MusterBox integrations.
- [Production checklist](https://docs.musterbox.org/getting-started/production-checklist.md): Everything to verify before you ship a MusterBox-connected game.
- [Register a game](https://docs.musterbox.org/guides/register-a-game.md): Register your game in MusterBox and create a browser-safe, origin-scoped game key.
- [Package & install](https://docs.musterbox.org/guides/package-and-install.md): Vendor, verify, and install the MusterBox SDK for your target.
- [Mutual-claim result flow](https://docs.musterbox.org/guides/second-session-mutual-claims.md): Why both participants must file a claim, and how the platform reconciles them.
- [Monitoring a player session](https://docs.musterbox.org/guides/monitoring-a-player-session.md): Observe session state, diagnostics, and the event plane to operate a game confidently.
- [Events & realtime](https://docs.musterbox.org/guides/events-and-realtime.md): Design good gameplay events and a healthy flow — validation limits, buffering, batching, and polling.
- [Purchase flow — SDK bridge](https://docs.musterbox.org/guides/purchase-flow-sdk-bridge.md): The end-to-end purchase flow and why it must stay SDK-mediated.
- [Environment integrity & anti-tamper](https://docs.musterbox.org/guides/environment-integrity-and-anti-tamper.md): The on-device integrity checks that gate purchases, and how to respond.
- [Report a security incident](https://docs.musterbox.org/guides/report-security-incident.md): How to report a compromised device, suspected abuse, or SDK vulnerability.
- [Migrate SDK versions](https://docs.musterbox.org/guides/migrate-sdk-versions.md): How SDK, ABI, and protocol versioning works — and how to upgrade safely.
- [FAQ](https://docs.musterbox.org/guides/faq.md): Frequent questions about the MusterBox SDK and platform.
- [SDK overview](https://docs.musterbox.org/sdk/overview.md): The MusterBox SDK surface — one Rust core, many packaging targets.
- [Installation](https://docs.musterbox.org/sdk/installation.md): Get the MusterBox SDK into your project — every packaging target.
- [Configuration](https://docs.musterbox.org/sdk/configuration.md): The MusterBox config profile, validation, and defaults.
- [Initialization & lifecycle](https://docs.musterbox.org/sdk/initialization.md): The MusterBox SDK lifecycle — initialize, start, authenticate, refresh, logout, shutdown.
- [Authentication](https://docs.musterbox.org/sdk/authentication.md): Player login, token refresh, and logout through the MusterBox SDK.
- [Sessions](https://docs.musterbox.org/sdk/sessions.md): Opening and consuming MusterBox match sessions from the SDK.
- [Events & realtime](https://docs.musterbox.org/sdk/events.md): Submit gameplay events and consume realtime session, wallet, and status events.
- [Status & lifecycle](https://docs.musterbox.org/sdk/status-and-lifecycle.md): Observe the MusterBox SDK status machine and diagnostics.
- [Secure purchases](https://docs.musterbox.org/sdk/purchases.md): The SDK's purchase bridge — environment pre-flight, PIN mint, and single-shot verification.
- [Security & integrity](https://docs.musterbox.org/sdk/security.md): The SDK's security model — environment integrity, redaction, and trust boundaries.
- [Errors](https://docs.musterbox.org/sdk/errors.md): SDK error codes, mapping tables, and handling guidance.
- [CLI](https://docs.musterbox.org/sdk/cli.md): The musterbox CLI — configuration, session, diagnostics, packaging, and certification.
- [Unity](https://docs.musterbox.org/engines/unity.md): Integrate the MusterBox SDK with Unity 2020.3+.
- [Godot](https://docs.musterbox.org/engines/godot.md): Integrate the MusterBox SDK with Godot 4.2+ via the GDExtension.
- [Unreal Engine](https://docs.musterbox.org/engines/unreal.md): Integrate the MusterBox SDK with Unreal Engine 5.3/5.4.
- [Bevy](https://docs.musterbox.org/engines/bevy.md): Integrate the MusterBox SDK into a Bevy application.
- [Cocos Creator](https://docs.musterbox.org/engines/cocos.md): Integrate the MusterBox SDK with Cocos Creator 3.8+.
- [Defold](https://docs.musterbox.org/engines/defold.md): Integrate the MusterBox SDK with Defold 1.6.5+.
- [Web (JS/TS/WebAssembly)](https://docs.musterbox.org/engines/web.md): Integrate the MusterBox web SDK — @musterbox/sdk-js over @musterbox/sdk-wasm.
- [Authenticate a player](https://docs.musterbox.org/api-reference/authentication/authenticate-a-player.md): Exchanges player credentials for an access token and a refresh token. The response is camelCase on the wire. The SDK derives its session expiry from `expiresIn` (seconds) and from JWT `exp` claims when present. Token signatures are never verified by the client — the backend is the identity owner.
- [Register a player account](https://docs.musterbox.org/api-reference/authentication/register-a-player-account.md): Creates a player account. This endpoint is exercised by the MusterBox e2e suite and the platform frontend; the SDK does not expose a registration capability in this version.
- [Rotate tokens with a refresh token](https://docs.musterbox.org/api-reference/authentication/rotate-tokens-with-a-refresh-token.md): Rotates the access/refresh token pair. The refresh token travels in the `x-refresh-token` header; the request body is empty (`{}`). Returns a new `accessToken`, `refreshToken` and `expiresIn` (seconds).
- [Revoke a server-side session](https://docs.musterbox.org/api-reference/authentication/revoke-a-server-side-session.md): Revokes the session identified by the bearer access token on the server. The request body carries the `device_id` associated with the session. The SDK calls this during `logout` and treats any server response as success.
- [Issue a match session](https://docs.musterbox.org/api-reference/game-sdk/issue-a-match-session.md): Opens a single match context for an authenticated player. This is the **start gate**: a session is only issued when
- [Submit a mutually-confirmed result](https://docs.musterbox.org/api-reference/game-sdk/submit-a-mutually-confirmed-result.md): Records a player's claim about how a match ended. The browser is never the sole authority: the claim is stored only after its session token validates to a real, unconsumed, non-expired match session bound to this user and match.
- [Mint a one-time PIN session (SDK-mediated)](https://docs.musterbox.org/api-reference/secure-purchases/mint-a-one-time-pin-session-sdk-mediated.md): Starts the secure purchase flow. The SDK runs an environment integrity check first; when any risk is detected the purchase is **blocked client-side** (no request is sent) and an `ENV_COMPROMISED` security event is reported.
- [Verify a submitted PIN (single-shot)](https://docs.musterbox.org/api-reference/secure-purchases/verify-a-submitted-pin-single-shot.md): Verifies the PIN the player entered against the minted one-time session. **Single-shot and never retried**: the backend consumes sessions on success and rate-limits failures.
- [Report a security event (best-effort audit log)](https://docs.musterbox.org/api-reference/secure-purchases/report-a-security-event-best-effort-audit-log.md): Best-effort security audit logging used by the SDK's pre-flight path (for example reporting an `ENV_COMPROMISED` block). The backend acknowledges with `202`; failures never fail the surrounding purchase flow.
- [Compatibility](https://docs.musterbox.org/resources/compatibility.md): The verified compatibility matrix for the MusterBox SDK 1.0.0.
- [Support](https://docs.musterbox.org/resources/support.md): How to get help, report issues, and engage the MusterBox team.
- [Legal](https://docs.musterbox.org/resources/legal.md): Legal pointers for MusterBox developers.
- [Terms of service](https://docs.musterbox.org/legal/terms.md): Terms of service for MusterBox developers.
- [Privacy policy](https://docs.musterbox.org/legal/privacy.md): Privacy expectations for MusterBox developers.
- [DMCA](https://docs.musterbox.org/legal/dmca.md): DMCA notice information for MusterBox developers.
- [API overview](https://docs.musterbox.org/api/api-overview.md): The MusterBox public API — authenticated player and game surfaces, verified against source.
- [Documentation backlog](https://docs.musterbox.org/docs-internal/documentation-backlog.md)
- [Sdk audit](https://docs.musterbox.org/docs-internal/sdk-audit.md)

## OpenAPI Specs

- [musterbox-public](/openapi/musterbox-public.yaml)

## Optional

- [Website](https://www.musterbox.org)