Security
When in doubt, Gatekeeper keeps the door shut.
Fail closed
If something goes wrong during an access check, players are denied instead of accidentally allowed in.
API protections
- Bound to localhost by default
- Authentication for admin access
- Rate limiting
- Request-size limits
- Authentication lockouts
- Private profile fields excluded from public responses
Recommendations
If you expose the API outside your server, use a TLS reverse proxy.
Keep your admin token private. Anyone with it can manage players, statuses, profile fields, logs, and configuration.