Skip to main content

Client API and API keys

The client API lets your own code do what you do in the game panel: list your servers, start and stop them, send console commands, manage files and backups. It is useful for a Discord bot that starts the server on request, a script that announces a restart, or your own status page.

Your code proves who it is with an API key. You create keys in the game panel and choose, for each key, which servers it can use and what it is allowed to do.

Create an API key​

  1. In the game panel, click your avatar at the top right and choose API keys.
  2. Under Create API key, type a Description you will recognize later, such as Discord bot.
  3. Under Servers, choose All servers or Only some servers (see below).
  4. Choose the permissions of the key (see below).
  5. Optionally, fill in Allowed IPs with the IP addresses that may use the key, one per line. Leave it blank to allow any IP address.
  6. Click Create.

The panel shows Your API Key in a window. Copy it and store it somewhere safe, such as a password manager or your bot's secret settings.

warning

The token is shown only once. When you close the window you cannot see it again. If you lose it, delete the key and create a new one.

Treat the token like a password: anyone who has it can do everything the key allows. Never paste it in a public channel, a screenshot or a public code repository.

Your keys are listed on the right of the same page, with their description and the servers they can use. To revoke a key, delete it there. Apps using it stop working at once.

Limit a key to some servers​

Under Servers you choose where the key works:

  • All servers: the key works on every server of your account, including servers you add later.
  • Only some servers: tick the servers the key can use. Any other server answers the key with an error.

A key for a bot that only runs one server should be limited to that server.

Permissions​

Each key has its own permissions. Give a key only what it needs.

PermissionWhat it allows
PowerStart, stop, restart and kill the server.
ConsoleSend commands to the server console.
Files: readList and download files.
Files: read & writeAlso upload, edit, rename and delete files.
Backups: viewSee the list of backups and download them.
Backups: fullAlso create, restore and delete backups.
Databases: viewSee the server's databases.
Databases: fullAlso create, change the password of and delete databases.
SettingsChange the server's settings, such as its name.

Two shortcuts fill in the list for you:

  • All: every permission. Use it only for tools you fully trust.
  • Read only: only the permissions that look but change nothing.
note

Schedules, subusers, activity and the pages of the panel extensions (such as the Minecraft and Rust managers) only work with a key that has All. A key with a smaller set of permissions gets an error on those parts of the API.

You can change the permissions of a key later from the list of keys. The token stays the same, so you do not need to update your bot or script.

Call the API​

Every request goes to this base address:

https://gamepanel.fenixhost.net/api/client

Send the token in the Authorization header, and ask for JSON:

Authorization: Bearer <token>
Accept: application/json

Each server has a short identifier, the 8 characters in its panel address (for example 1a2b3c4d in /server/1a2b3c4d). The list of servers also returns it as identifier. Use it as {id} in the examples below.

List your servers​

curl https://gamepanel.fenixhost.net/api/client \
  -H "Authorization: Bearer <token>" \
  -H "Accept: application/json"

The answer lists the servers the key can use, with their identifier and name.

Start a server​

curl -X POST https://gamepanel.fenixhost.net/api/client/servers/{id}/power \
  -H "Authorization: Bearer <token>" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -d '{"signal":"start"}'

The other signals are stop, restart and kill. This needs the Power permission.

Send a console command​

curl -X POST https://gamepanel.fenixhost.net/api/client/servers/{id}/command \
  -H "Authorization: Bearer <token>" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -d '{"command":"say Restarting in 5 minutes"}'

This needs the Console permission, and the server must be running.

When something fails​

  • 401: the token is wrong, incomplete or was deleted.
  • 403: the key is not allowed to do this: the request comes from an IP address that is not in Allowed IPs, or the key lacks the permission for this action.
  • 404: the server identifier is wrong, or the key cannot use this server.
  • 429: too many requests. Wait a little and slow down. Do not send requests in a tight loop.