Hosted rooms on tickcli.com

Your game page stays where it is (your site, itch.io, GitHub Pages). Its rooms run on tickcli.com. Manage everything at tickcli.com/account/keys after you sign in with Google.

Hosting is in beta: per deployment up to 5 rooms and 32 players at once; 3 deployments and 5 API keys per account.

Deployment id

A public id like dep_ab12cd34ef56 plus the list of sites allowed to use it. Safe to put in your page: a page on any other site is refused.

1. On the API keys page, click New deployment, give it a name, list your sites.
2. Copy the script tag and put it in your game page in place of the two room.js and game.js tags:

<script src="https://tickcli.com/c/dep_ab12cd34ef56.js" data-game="my-game"></script>
<script>
  Game({ title: "My game", multiplayer: { max: 4 } /* ...the rest as usual */ });
</script>

data-game names the game: pages with the same name share rooms. Add data-version="2" when a new version should not mix with players still on the old one.

Sites

You write	It allows
https://mygame.example	that site only (port 443)
https://*.mygame.example	any one-level subdomain: play.mygame.example
https://mygame.example:*	that site on any port
http://localhost:*	your laptop on any port (http works for localhost only)
https://*.itch.zone	itch.io game pages
https://*.github.io	GitHub Pages

No paths, and no http for real sites. Changing the list or turning the deployment off takes effect at once and closes its open rooms.

Test

Test on each deployment runs on the live server: loads the script, joins a room as a page from each listed site, checks that any other site is refused. Type your own site in Also try a site to see if it would be let in.

API keys

Secret keys (tk_...) for scripts and CI. Shown once, stored only as a hash. They can list, create, change and delete deployments; they cannot make or see other keys (that needs the site).

Test this key right after you make one, or paste a key into Check a key. From a terminal:

export TICKCLI_KEY=tk_...

# is the key working?
curl -s https://tickcli.com/api/v1/whoami -H "Authorization: Bearer $TICKCLI_KEY"

# list deployments
curl -s https://tickcli.com/api/v1/deployments -H "Authorization: Bearer $TICKCLI_KEY"

# create one
curl -s https://tickcli.com/api/v1/deployments -H "Authorization: Bearer $TICKCLI_KEY" \
  -H "Content-Type: application/json" -d '{"name":"My game","origins":["https://mygame.example","http://localhost:*"]}'

# change its sites, turn it off or on, run its test, delete it
curl -s -X PATCH https://tickcli.com/api/v1/deployments/dep_ab12cd34ef56 -H "Authorization: Bearer $TICKCLI_KEY" \
  -H "Content-Type: application/json" -d '{"origins":["https://mygame.example"]}'
curl -s -X PATCH .../deployments/dep_ab12cd34ef56 ... -d '{"on":false}'
curl -s -X POST  .../deployments/dep_ab12cd34ef56/test ... -d '{"origin":"https://mygame.example"}'
curl -s -X DELETE .../deployments/dep_ab12cd34ef56 ...

Errors come back as {"error": "..."} with a 4xx status. Revoke a key on the API keys page; anything using it stops at once.

Your own server instead

The same script tag and site rules work on a server you run yourself: see Hosting it (tickcli-js/remote).