Skip to main content

Client API and API keys

The client API lets your own code do what you do in the game panel: list servers, start and stop them, send console commands, manage files and backups. Typical uses: a Discord bot that starts the server on request, a restart announcer, a status page.

Code authenticates with an API key, created in the game panel. For each key you choose which servers it can use and what it may do.

Create an API key​

  1. In the game panel, click your avatar at the top right and choose API keys.
  2. Under Create API key, type a Description, such as Discord bot.
  3. Under Servers, choose All servers or Only some servers (see below).
  4. Choose the permissions of the key (see below).
  5. Optionally, fill in Allowed IPs, one per line. Blank allows any IP address.
  6. Click Create.

The window Your API Key shows the token. Copy it to a password manager or your bot's secret settings.

warning

The token is shown only once. If you lose it, delete the key and create a new one.

Treat the token like a password: anyone who has it can do everything the key allows. Never paste it in a public channel, screenshot or repository.

Your keys are listed on the right of the same page. Deleting a key revokes it; apps using it stop working at once.

Limit a key to some servers​

Under Servers you choose where the key works:

  • All servers: the key works on every server of your account, including servers you add later.
  • Only some servers: tick the servers the key can use. Any other server answers the key with an error.

Limit a bot that only runs one server to that server.

Permissions​

Give each key only what it needs.

PermissionWhat it allows
PowerStart, stop, restart and kill the server.
ConsoleSend commands to the server console.
Files: readList and download files.
Files: read & writeAlso upload, edit, rename and delete files.
Backups: viewSee the list of backups and download them.
Backups: fullAlso create, restore and delete backups.
Databases: viewSee the server's databases.
Databases: fullAlso create, change the password of and delete databases.
SettingsChange the server's settings, such as its name.

Two shortcuts fill in the list for you:

  • All: every permission. Use it only for tools you fully trust.
  • Read only: only the permissions that look but change nothing.
note

Schedules, subusers, activity and the pages of the panel extensions (such as the Minecraft and Rust managers) only work with a key that has All. A key with a smaller set of permissions gets an error on those parts of the API.

You can change a key's permissions later from the list. The token stays the same.

Call the API​

Base address for every request:

https://gamepanel.fenixhost.net/api/client

Send the token in the Authorization header, and ask for JSON:

Authorization: Bearer <token>
Accept: application/json

Each server has a short identifier, the 8 characters in its panel address (for example 1a2b3c4d in /server/1a2b3c4d). The list of servers also returns it as identifier. Use it as {id} in the examples below.

List your servers​

curl https://gamepanel.fenixhost.net/api/client \
  -H "Authorization: Bearer <token>" \
  -H "Accept: application/json"

The answer lists the servers the key can use, with their identifier and name.

Start a server​

curl -X POST https://gamepanel.fenixhost.net/api/client/servers/{id}/power \
  -H "Authorization: Bearer <token>" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -d '{"signal":"start"}'

The other signals are stop, restart and kill. This needs the Power permission.

Send a console command​

curl -X POST https://gamepanel.fenixhost.net/api/client/servers/{id}/command \
  -H "Authorization: Bearer <token>" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -d '{"command":"say Restarting in 5 minutes"}'

This needs the Console permission, and the server must be running.

When something fails​

  • 401: the token is wrong, incomplete or was deleted.
  • 403: the key is not allowed to do this: the request comes from an IP address that is not in Allowed IPs, or the key lacks the permission for this action.
  • 404: the server identifier is wrong, or the key cannot use this server.
  • 429: too many requests. Slow down; do not send requests in a tight loop.