Calling external APIs from your game

Games run in a sandboxed, opaque-origin iframe and are sealed by default — they can only reach first-party infrastructure. To let a game reach an external host, declare it at upload in connectHosts (on upload/init or games/:id/versions, or connectHosts in game.json for the CLI):

{ "gameId": "<id>", "runtime": "html5", "filename": "game.zip",
  "connectHosts": ["https://api.example.com"] }

The declared hosts are injected into the game's CSP, so the browser enforces the allowlist — the game can reach what you declared and nothing else. One declaration covers every resource type: fetch/XHR, <img>, audio/video, and fonts.

• Exact HTTPS hosts only — no wildcards, IPs, localhost, or internal names.

• Up to 10 hosts, re-reviewed by moderation on every version.

• The target API must return Access-Control-Allow-Origin: * and use no cookies/credentials (the requester's origin is opaque null).

If the data is static, bundling it in the zip (e.g. data.json) is simpler — no network, no CORS, nothing to review.