API Keys & Auth

Two auth modes

Current Hosted Auth

The hosted package routes reuse shared Continual API keys stored in core.api_keys. The CLI sends them as bearer tokens.

Authorization: Bearer <continual-api-key>

Required server-side checks

• The key must exist, be active, and not be expired.
• The key must include the required hosted package scope.
• The key must resolve to a real owner account.
• The owner must have continual_pro.
• The owner must be allowed to push the target hosted game.

Public scopes

• mdl.hosted.diff for authenticated inventory comparison
• mdl.hosted.sync for authenticated upload and finalize operations

Creator key lifecycle

Creators manage hosted package keys from each hosted game workspace under /platform/games/<slug>/api-keys. The surface supports:

• Create a key with a label, scopes, and optional expiry date.
• One-time secret reveal at creation — the plaintext is not stored or shown again.
• Inspect label, scopes, created-at, last-used, and expiry at any time.
• Revoke a key without affecting the rest of the account.

CI guidance

Non-interactive workflows should use environment variables and injected secrets, not checked-in config files. Keep CI credentials scoped narrowly and rotate them when access changes.

export MDL_BASE_URL="https://mdl.continualmi.com"
export MDL_API_KEY="your-creator-key"

mdl whoami
mdl push --package . --game my-game

Next