API Keys
Create and manage API keys for the WardenCore API
API keys let external tools, bots, and scripts call the WardenCore API on your server's behalf — a custom stats dashboard, a Discord bot, an automated moderation script, and so on.
Manage them in the panel under Settings → API.
Premium feature
The API is available on servers with an active premium plan. If the server isn't premium, key creation is disabled; if premium lapses, existing keys stop working until it's renewed.
Creating a key
Open Settings → API
Open Settings in the sidebar and select API.
Click "Create key"
Give the key a descriptive name so you can recognize it later — for example, "Discord bot" or "Stats dashboard".
Select scopes
Tick the scopes the key needs in the table. Each scope is resource:action (e.g. server:read, players:write) with a description of what it grants, and only scopes backed by a live endpoint appear. A key can never exceed your own permissions on the server, so grant the minimum a tool needs.
Set an expiry (optional)
Choose how long the key stays valid — Never expires (default) or 30 / 90 / 365 days. Once past its expiry a key is rejected with 401 unauthorized; rotate or replace it before then.
Copy the key
Click Create key. The full key is shown once, in a dialog — copy it immediately with the Copy button. The list only ever shows a masked wc_live_…xxxx preview afterwards.
Save your key now
The full key is displayed only once, right after creation. If you lose it, you can't retrieve it — revoke the old key and create a new one.
Principle of least privilege
Grant only the scopes a tool actually needs. A stats dashboard needs read scopes only; a bot that runs commands needs the matching console:write scope.
Rotating a key
Click the Rotate action on a key's row to mint a new secret in place — the key keeps its id, name, scopes, and expiry, but the old secret stops working immediately. The new secret is shown once, just like on creation. Use this if a key may have leaked, without reconfiguring which key your integration points at.
Revoking a key
Click the Revoke action on a key's row and confirm. Revocation takes effect immediately — any application using that key starts getting 401 unauthorized.
Using a key
Send the key as a bearer token to https://api.wardencore.ru/v1:
Authorization: Bearer wc_live_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxSee the API Reference for the base URL, error format, rate limits, and conventions.
Always use HTTPS. A key is a secret — never commit it to a repository or expose it in client-side code.
Common issues
401 Unauthorized
The key is missing, mistyped, expired, or revoked. Check that it's sent as Authorization: Bearer wc_live_… and still exists in Settings → API.
403 premium_required
The API is a premium feature. Creating or using a key requires an active premium plan on the server — renew it in Billing to restore access.
403 insufficient_scope
The key is valid but lacks a scope the request needs — the error's details.missing_scope names it. Create a new key with the required scope.