Authentication and API contracts

Create the OAuth application at BeatKhana developer applications. Use the precise backend callback URL. Store client ID/secret only in backend environment; the website starts login by redirecting to the backend.

The server requests the fixed compcube scope. At startup it fetches BeatKhana's RS256 public key, then validates tokens locally. Plugin Socket.IO authentication additionally requires token type beatkhana:game, a provider-verified platform ID, and a plugin version.

Contracts

• Swagger UI: GET /docs
• OpenAPI JSON: GET /openapi.json
• Human Socket.IO docs: GET /docs/ws
• Machine Socket.IO contract: GET /socket-docs.json
• Health: GET /health

Client-to-server Socket.IO acknowledgements are always one of:

{ "ok": true, "data": {} }

{ "ok": false, "error": { "code": "ERROR_CODE", "message": "Safe message" } }

Replay publishing runs beside Socket.IO and validates the plugin version through X-CompCube-Plugin-Version.