MAJACLOUDSecurity
What MAJACLOUD protects for you, and what stays your responsibility.
Keys#
- The client key only identifies the project; every player endpoint also needs the player's own token.
- Secret keys are stored as SHA-256 hashes and shown once. Rotate either key on the API keys page; rotating the client key breaks builds that still use the old one.
Never put the secret key (
sk_live_…) in a game build or web page. Anything shipped to players can be read.Player tokens#
- Access tokens expire after an hour and are refreshed automatically with a rotating refresh token.
- Reusing an old refresh token revokes that session everywhere.
HTTPS#
- The API refuses plain HTTP except from localhost and sends HSTS over HTTPS.
Server authority#
- Scores, rewards and wallets are validated on the server and never trusted from the client.
- Anything the client can read can be inspected. Keep secrets and authoritative logic on your server, using the secret key.
Signed config#
- Remote config is signed with RSA-SHA256 and verified on the device before it is used, so a proxy or a modified network response cannot change your values.
Player data#
- You can inspect and delete any player in the dashboard; deleting a project removes all its data. IP addresses in logs are stored as keyed hashes.