The Public API is a RESTful service that allows authenticated access to various game endpoints. Whether you're building a personal tracker, or a guild management tool, the API provides the foundation for extending IdleMMO beyond the main interface.
Getting Started
API keys can be generated from your account settings. Each key can be configured with specific scopes to limit access to only the data you need. Full documentation of available endpoints, request formats, and response structures can be found on the API settings page.
The API uses Bearer token authentication. Include your API key in the Authorization header of all requests.
Using API Keys in Third-Party Software
Important: This section ONLY applies to applications where users input their own API keys. If you're using your own API key to serve data (e.g., from a database or website you control), these disclosure requirements do not apply.
When These Requirements Apply
These requirements apply when:
Users enter their own API keys into your application
Your application makes API calls on behalf of other users using their credentials
These requirements DO NOT apply when:
You use only your own API key to fetch data
You serve processed data from your own API key to users
Users never provide their API keys to your application
Examples: Guild websites showing member stats, leaderboard sites, data analysis tools using data you obtained from your own API key
If users provide their API keys to your application, you MUST follow all requirements below. Failure to do so will result in account suspension.
Required Disclosures for User API Key Applications
Any application that accepts IdleMMO API keys from users must clearly display the following information before requesting access:
Data Storage and Retention
How is data obtained from the API stored?
Specify whether data is stored locally on the user's device, in a database, or not stored at all
If using cloud storage, indicate the provider and region
How is the API key itself stored?
Detail your storage method (e.g., encrypted local storage, secure database, session-only memory)
If not stored, explain how authentication persists between sessions
How long is data retained?
Define retention periods (e.g., until session close, 30 days, until account deletion)
Explain any automatic cleanup processes
Access and Privacy
Who can access the data besides the end user?
List all parties with potential access (e.g., "Only the user", "Application developers for debugging", "Public leaderboards")
Specify any analytics or monitoring services used
What is the purpose of storing the data?
Provide clear use cases (e.g., "Statistical analysis of drop rates", "Offline progress tracking", "Guild performance metrics")
Explain any secondary uses of the data
How can users request deletion of their data?
Provide a clear process for data deletion requests
Include expected timeframe for deletion completion
Required Scopes
List all API scopes your application requires
Explain why each scope is necessary
Indicate any optional scopes and their benefits
If your application does not have a UI (such as a Discord bot), you can list this disclosure using a third party application, such as GitHub gists.
User Agent Requirements
Applications intended for multiple users must set a custom User-Agent header identifying your application. This helps prevent service disruptions if multiple users access the API from the same server IP address.