GameHostCloud API Overview

Updated 2026-09-09

GameHostCloud REST API

Overview

The GameHostCloud API lets you list your servers, read your account and balance, and start, stop, restart or force-stop a server from your own scripts.

Base URL

All endpoints live under a single gateway:

https://<your-project>.supabase.co/functions/v1/api-gateway

The exact base URL for your account is shown in Dashboard → Settings → API keys → Documentation.

Authentication

Every request needs your API key in the x-api-key header:

curl -H "x-api-key: ghc_your_key_here" \
  "https://<your-project>.supabase.co/functions/v1/api-gateway/servers"

Creating API keys

  1. Dashboard → Settings → API keys
  2. Click Generate new key
  3. Choose the permissions and an optional expiry date
  4. Copy the key — it is shown only once

Permissions

PermissionDescription
servers:readList and view servers
servers:controlStart, stop, restart and force-stop servers
billing:readView your balance
account:readView your account details

Endpoints

MethodEndpointPermission
GET/servers?limit=50&offset=0servers:read
GET/servers/{id}servers:read
POST/servers/{id}/startservers:control
POST/servers/{id}/stopservers:control
POST/servers/{id}/restartservers:control
POST/servers/{id}/killservers:control
GET/accountaccount:read
GET/balancebilling:read

Listings return at most 100 rows per page; use limit and offset to page through them.

Rate limits and abuse protection

The API is protected in several layers so that a flood of requests cannot slow the service down for anyone else.

LimitValue
Requests per API key120 / minute, 40 / 10 seconds, 3 000 / hour
Control actions (start, stop, restart, kill)20 / minute, 5 / 10 seconds
Simultaneous requests per API key8
Requests before authentication (per IP address)120 / minute, 30 / 10 seconds
Failed or missing API keys (per IP address)20 / 5 minutes
Request body size64 kB

Successful responses carry X-RateLimit-Limit, X-RateLimit-Remaining and X-RateLimit-Reset. When a limit is exceeded you get HTTP 429 with a Retry-After header — wait for that many seconds before retrying, and back off instead of retrying in a tight loop.

Only GET, POST and OPTIONS are accepted; any other method returns 405.

Error codes

CodeMeaning
400Unknown endpoint for this resource
401Invalid or missing API key
403Insufficient permissions
404Resource not found
405Method not allowed
413Request body larger than 64 kB
429Rate limit exceeded — see Retry-After
500Server error