Skip to content
MMX

Authentication

Game requests

Your trusted game gateway authenticates players, authorizes trades, and forwards the account UUID in x-player-id.

  1. Strip client-supplied x-player-id headers.
  2. Authenticate the player and authorize the account, market, and asset reservation.
  3. Set x-player-id to the authorized account UUID before forwarding to MMX.

Permit those gateways to reach REST on 8000. In Kubernetes, configure networkPolicy.gameServers for their pod labels or source CIDRs; the default label is mmx.io/role=game-server. Use a CNI that enforces NetworkPolicy.

Operators

The console supports password sessions and OIDC:

RolePermissions
ViewerRead exchange state
OperatorAlso edit markets, halt, resume, and cancel orders
AdminAlso manage webhooks, settings, and sign-in

The native CLI and gateway admin routes accept the MMX_ADMIN_TOKEN bearer credential. Store it in your operator secret manager.

For OIDC, register /admin/v1/oidc/callback on the console's public origin and map provider groups to roles. See operator configuration.

Private subscriptions

WebSocket user tokens use HMAC-SHA256 with WS_PLAYER_TOKEN_SECRET (32 bytes minimum), an account UUID in sub, and Unix expiry in exp. Subscription availability is listed in feature status.