API keys

Unreal

One key for the editor, a different one for your dedicated server, and the plugin refuses to confuse them.

The toolbar button

Click Raid State in the level editor toolbar. It shows what the project is currently configured with, and lets you set both keys in one place.

Setting	Value	Why
Development key	ex_dev_…	Editor, PIE and client builds
Production key	ex_live_…	Dedicated server builds only
Base URL	https://api.raidstate.com	Shared by both

The same panel has a Set up demo content button, which fills a development environment with a player, a stash and some loot so there is something to look at on the first run. See Demo content.

Why they are stored differently

The development key lives in project settings, which is a file in your repository. That is fine: it reaches only a development environment, where anonymous sign-in is allowed and nothing is real.

A production key must never touch project settings

Anything in Config/DefaultGame.ini ships inside your packaged game. A production key there is a production key every player has, and it can rewrite every stash in your live economy. The plugin refuses an ex_live_ key loaded from project settings — not a warning, a refusal.

So the production key is stored in your per-user editor settings, which are not source controlled and never cooked into a build. The toolbar uses it for one thing: writing the environment file you deploy alongside your dedicated server.

Getting the key to the server

At runtime the server reads EXTRACTOR_API_KEY from its environment. That is the only supported route in production, because it is the only one that does not put the key in a file somebody might ship.

what the toolbar writes for you

# Saved/RaidState/server.env
# deploy this next to your dedicated server, do not commit it
EXTRACTOR_BASE_URL=https://api.raidstate.com
EXTRACTOR_API_KEY=ex_live_…

It is gitignored for you

The button writes a .gitignore beside the file on first use. A production key committed by accident is a key you have to revoke, reissue and redeploy.

Which key is used when

EXTRACTOR_API_KEY in the process environment always wins, wherever it is set.
Otherwise, in the editor or a client build, the development key from project settings is used.
Otherwise nothing: the plugin says no key is configured rather than failing silently.

Scopes

A key carries game:read, game:write and catalog:write. Catalogue writes are separated because the blast radius is different in kind: changing what an item is reprices every copy of it that anybody owns.

Player tokens can be narrowed further. A companion app that shows someone their stash should ask for player:read and nothing else. Narrowing intersects with what the session would have been granted anyway, so asking for a scope never produces one.