The control plane for
every CPM game
A production API around the real game integrations — CPM, CPM2, Garage and Traffic Racer. HMAC-signed requests and responses, replay protection, per-key scopes and limits, async jobs with live progress, and a realtime operations console.
Four real games, one API
Every integration talks to the live game backend — status and latency below are real.
Everything you need to run it safely
HMAC-SHA256 over a canonical request with timestamp + nonce. Constant-time verification and replay protection.
Public/private tokens and an HMAC secret per key, with per-game permissions, scopes and distributed limits.
Long operations become tracked jobs with live per-step progress — mass clone, farm, full unlock.
WebSocket + SSE over Redis Streams/Pub-Sub. No polling: the server pushes changes.
Prometheus metrics, structured logs with redaction, request/audit/security trails.
Nothing critical lives in one instance's memory; rate limits and realtime span instances.
A signed round-trip, end to end
Predictable, signed, documented
Every request is authenticated by an HMAC signature over its canonical form. Responses come back signed too, so clients can verify integrity end to end. SDK examples in Go, TypeScript, Python, PHP and curl live in the docs.
POST /v1/cpm2/money
X-API-Key: cpm_pk_live_…
X-Timestamp: 1790000000
X-Nonce: 550e8400-e29b-41d4-a716-446655440000
X-Signature: 9bfcb28f…
{ "token": "…", "uid": "…", "amount": 999999999 }