To access all REST endpoints, the game developer must create apps within the platform. A game developer needs to have at least 2 apps :

1. Server side app (1 or more, some game developers choose to run everything on one server) - ONLY FOR MULTIPLAYER GAMES
2. Client app (as many as needed for each game you run)

The server side app is a confidential app with both a client ID and client secret.
The client side app are public apps (e.g. for Android/iOS/Javascript games). They have a client ID and a redirect URI to receive the access token.
All authorisation flows follow OAuth2.0 standards.
The server side and client side apps are created for you by your account manager.

The game server logs-in via a confidential application credential. An access token and a refresh token is returned to the server. The access token is issued for both the app and the user associated with the app (the app creator).

POST /auth/token HTTP/1.1
Host: api.mmocircles.com
Content-Type: application/x-www-form-urlencoded
Cache-Control: no-cache

grant_type=client_credentials&client_id=23&client_secret=testsecret

The game server logs-in via a confidential application credential. An access token and a refresh token is returned to the The access token returned must be used to access all other endpoints. It must be present in the Authorization header for each subsequent request.

Authorization: Bearer CfDJ8K31xx3uPvNAs   …    RUd0yuT2kM

All clients are authenticated using the OAuth2.0 authorisation code flow

The main login flow for mobile users works like this:

1. 1. Create a button that says "Login with GGP" in your app
2. 2. When user clicks on the button, redirect users to our platform through the following url:
   
   https://api.mmocircles.com/auth/authorize?client_id=[client_id]&response_type=code&redirect_uri=[redirect_uri]
   
   * Replace [client_id] and [redirect_uri] with the settings specific to your game
   
   
3. 3. After the user enters their credentials, the browser will redirect back to your app via deeplink. For a tutorial on how deeplinks in Unity Engine works, click here.

The following video shows the deeplink + redirect URI in action:

(https://www.digitalocean.com/community/tutorials/an-introduction-to-oauth-2)

The below outlines a step by step instructions with sample code on handling the authorization code:

1. User is presented with a button: “Login with MMOCircles”
2. This takes the user to the login endpoint on their browser

Example endpoint:

https://api.mmocircles.com/auth/authorize?client_id=22&response_type=code&redirect_uri=https://playdat.com

The staging API endpoint (test API) is http://api.mmocircles.com
The authorize endpoint is: /auth/authorize
The GET parameters (query string) contains

• client_id: 22
• response_type: token
• redirect_uri: https://playdat.com

This will take the users to a login page, where they can register or signup with MMOCircles.

After signing-in or registering, they will be taken to the OAuth consent screen:

If the user denies the request, they will be redirected to the redirect URI you specify, plus a query parameter with the access denied error:

https://playdat.com/?error=access_denied&error_description=The%20authorization%20was%20denied%20by%20the%20resource%20owner.

If the user allows the request, the user agent will be redirected to the redirect URI with the access token as part of the hash string:

https://playdat.com/?code=CfDJ8JP6P...pmQlGO4Zw

Note : the redirect URI is configurable, e.g. for an Android app, you can set the redirect URI to an internal link within your app

With the authorisation code in hand, you are ready to request an access token from the server :

POST /auth/token HTTP/1.1
Host: api.mmocircles.com
Content-Type: application/x-www-form-urlencoded
Cache-Control: no-cache

grant_type=authorization_code&code=CfDJ8JP…dClicbA&client_id=22&redirect_uri=https%3A%2F%2F
playdat.com

The result would be an access token and a refresh token :

{
"resource":"resource_server",
"scope":"openid email profile offline_access",
"token_type":"Bearer",
"access_token":"CfDJ8J…JPUA",
"expires_in":3600,
"refresh_token":"CfDJ8JP6…vIn0."
}

With both access tokens in hand, you are ready to call all the gem related API endpoints.

Each game can have multiple products that can be purchased by users via GGP in-game. To create your products and upload them, contact your account manager to help you through the process.

Once your products are created, you can use the following APIs to GET and purchase products:

GET products: https://docs.mmocircles.com/mmocapi.html#!/Products/GetProductsAsync
Purchase products: https://docs.mmocircles.com/mmocapi.html#!/Products/GetProductsAsync

A pool is where all the users’ gems are stored during the game. It’s like the “house” in a casino, it will collect all the users’ wagers before the game starts. As the game progresses, the gems in the pool may be distributed to different users.

Before the game starts, all users must “join” the pool and deposit an initial wagering number of gems.

When each user deposits gems in the pool, it is tracked to the user. The game server can create transactions within the pool, which redistributes the gems to different users depending on the game logic.

Note : the transactions created during the pool are NOT committed, so the users’ GGP balances outside this game does not change until the game is finished.

When the game ends, the pool is “committed”, which means all transactions are applied, and all the users’ gems are unlocked and final amount deposited into the users account.