Authentication

Every request needs an API key sent as a bearer token:

curl "https://api.wavedash.com/api/games/$GAME_ID/leaderboards/by-name/$LEADERBOARD_NAME" \
  -X PATCH \
  -H "Authorization: Bearer $WAVEDASH_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"visible": true}'

Creating a key

Create one in the Developer Portal under API Keys. The key is shown once — store it in your secret manager immediately.

This is the same key the CLI uses, so if you already set WAVEDASH_TOKEN for CI you can reuse it. See CLI authentication.

Scope

A key acts on your behalf for every game your team can access. There's no per-game or read-only key today, so treat it as a full-access credential:

• Keep it on a server you control. Never ship it in a game build, client-side script, or public repo.
• Use the SDK for anything running in a player's browser.
• Rotate by creating a new key and deleting the old one in the Developer Portal.

Failures