API overview

PlayWave Game Server API authentication, base URL, and response format

Base URL

Environment	URL	Status
Dev	https://wave-api.playwave.dev/v1	Available
QA	https://wave-api-qa.playwave.dev/v1	Coming soon
Live	https://wave-api.playwave.io/v1	Coming soon

Authentication

All requests require the X-Api-Key header.

X-Api-Key · string · required

Per-game API Key. The server matches the SHA-256 hash of the key to the game configuration.

API Keys are currently issued by the PlayWave operations team. Contact your PlayWave representative to request a key for your game.

Content-Type · string · required

Must be application/json.

API Key must only be used server-side. If exposed to clients, regenerate it immediately from the console.

Response format

Success response

{
  "success": true,
  "request_id": "req_abc123",
  "data": {
    // Endpoint-specific response data
  }
}

Error response

{
  "success": false,
  "error": {
    "code": "INVALID_API_KEY",
    "message": "API Key is invalid or inactive",
    "timestamp": "2026-03-06T12:00:00.000Z"
  }
}

Endpoints

The game server calls 3 APIs.

Method	Path	Description
POST	/v1/game/session/verify	OTT verification + game session creation
PATCH	/v1/game/session/heartbeat	Game session heartbeat (every 2 min)
DELETE	/v1/game/session/end	Game session termination

Common error codes

Code	HTTP	Description
BAD_REQUEST	400	Request body validation failed
INVALID_API_KEY	401	Invalid API Key
RATE_LIMITED	429	Request rate limit exceeded
INTERNAL_ERROR	500	Internal server error