Authentication - ERA API Documentation

Send your key in the Authorization header on every request:

Authorization: Bearer era_k3j9x0abq2mn_bhnbacATvnxO31TPngj7QtIO-L5123-XKU9VTGMcnqU

X-Api-Key: <key> and ER:LC’s Server-Key: <key> also work.

Key format

era_<server id>_<secret>

The server id says which private server the key belongs to. The secret is 256 bits of randomness. ERA stores only a salted hash of it, so nobody can read your key back, not even ERA staff. Anyone with the key can use it, so treat it like a password.

Scopes

Scope	Lets the key
`read`	Read server info, players, staff, teams, vehicles, bans, logs and events. Every key has this.
`commands`	Run approved commands. Choose it when you make the key.

A key’s scopes can’t change. To give a tool more access, make a new key and revoke the old one.

Check a key

GET /v1/me returns the key’s name, its scopes and which server it belongs to. Use it as a “test connection” button.

Keep keys safe

Only call the API from a server, never from a browser or a Discord client. The API sends no CORS headers on purpose.
Give each tool its own key. Then you can revoke one without breaking the others.
A server can have up to 5 keys. Only the server owner can make or revoke them, from the in-server console.
Repeated bad keys from the same IP get rate limited.