Sends the minimum project reference, event, timestamp, and nonce.
Security and architecture
Treat every external client as a narrow, revocable boundary.
The game, world, plugin, or script should never become an invisible administrator. Give each project explicit capabilities, keep secrets server-side, reject replayed requests, and preserve enough audit evidence to revoke or recover safely.
Checks project status, signature, allowed event, clock window, and replay state.
Calls only the identity, entitlement, support, or analytics capability explicitly allowed.
Records the decision without returning secrets or unrelated private data.
Trust rules
The defaults a production studio bridge should preserve.
Disabled until approved
An owner or administrator explicitly enables the connector for a selected project.
Least capability
Identity, entitlement, events, support, and analytics are separate permissions—not implied administrator access.
Secrets stay server-side
Payment credentials, SMTP credentials, private keys, and unrelated provider tokens never belong in client payloads.
Signed and replay-aware
Verify signatures, timestamps, nonces, accepted event types, payload limits, and rate limits before provider work begins.
Instant revocation
Disable one project or rotate one credential without taking unrelated sites, clients, or provider data offline.
Audited decisions
Record accepted and rejected operations with safe references, never raw secrets or unnecessary private content.
Launch gate
Before production credentials
- Use a separate non-production project and credential.
- Confirm allowed event types and payload size limits.
- Test invalid signatures, expired timestamps, and repeated nonces.
- Verify a revoked project fails closed.
- Test as a normal member, not only as an owner.
- Confirm audit records contain no credentials or private payment data.
- Document rotation, outage, and incident ownership.
Never grant by default
Keep these outside the connector
- Broad administrator or database access
- Permission to alter its own capabilities
- Payment, mail, storage, or signing secrets
- Private health, legal, or unrelated member data
- Unbounded file access or arbitrary server execution
- Silent cross-project access
- Automatic destructive recovery behavior
Next decision
Match the boundary to one supported client.
Compare connector formats and declared capabilities before preparing a licensed implementation package.