API Groups#
| Group | Purpose |
|---|
| Chizmis Authentication | Client validation, hosted sign-in/sign-up, callback token exchange, saved account lookup, session verification, and logout. |
| Activity Tracking | Game launch creation, tracked sessions, gameplay event ingestion, event mapping, and session lifecycle. |
| ChizPay Wallet & Transactions | Centralized wallet lookup, wallet transfers, game debit/credit transactions, and game ledger retrieval. |
Base URLs#
| API Group | Base URL |
|---|
| Chizmis Hosted Authentication | https://access.chizmis.com |
| Chizmis Authentication | https://api.chizmis.com |
| ChizVerse Core Auth | https://api-chizverse.beespokedev.com |
| Activity Tracking | https://api-chizverse.beespokedev.com |
| Leaderboards | https://api-chizverse.beespokedev.com |
| ChizPay Wallet & Transactions | https://api.chizmis.com |
API-Only Integration Flow#
Use this flow when integrating directly with HTTP endpoints without @ccci/chizverse-sdk. Your integration must manage token storage, session keys, event ordering, batching, heartbeat timing, retries, and final session events.Credential Map#
| Credential | Obtained from | Used for |
|---|
Chizmis token (t) | Hosted Chizmis callback | Chizmis account endpoints and ChizPay authorization header |
| ChizVerse bearer | POST /core/public/auth/chizmis | Game Manager Create Launch authorization header |
launchToken | Game Manager Create Launch | Game Manager Create Tracked Session request body |
sessionKey | Game Manager Create Tracked Session | x-session-key for checkpoints, saved progress, and event batches |
sessionId | Game Manager Create Tracked Session | Event ownership and ChizPay gameSession linkage |
Common Authentication#
Protected endpoints do not all use the same credential:Chizmis and ChizPay: authorization: Bearer <chizmis-token>
Game Manager launch creation: authorization: Bearer <chizverse-token>
Game Manager session activity: x-session-key: <session-key>
API paths include their service prefix, for example /access/v1.0/..., /game-manager/v1.0/..., /leaderboard/v1.0/..., and /chizpay/v1.0/....ChizPay write requests use replay-protected request integrity fields in the body:nonce: unique per request
timestamp: epoch milliseconds
signature: HMAC or server-issued request signature over the canonical request payload
Modified at 2026-07-30 06:57:16