Use our plugin with your WordPress theme, or have your developer connect a custom website through the API. Both use the same Games account and launch allowance.
Connect. Open Rivalless Games → Settings in WordPress, paste the key and click Connect.
Next: import and display games
In Rivalless Games → Catalogue sync, choose providers or individual games. Select Import & publish to make new games public immediately, or Import as drafts to review them first. Existing drafts stay drafts; later syncs preserve your titles, content and publication choices.
Place the Games Catalogue block or [rivalless_games_catalogue] on a WordPress page. Only published, visible games appear. Use Public display in plugin settings to adjust player text and colours.
Updating an existing installation?
Upload the latest plugin ZIP and choose to replace the installed version. Your saved connection, settings and games stay in place. There is no need to create another account or regenerate a working API key.
The credential stays on your WordPress server. Downloading or installing the plugin does not buy a subscription. Compare launch allowances →
Connect a non-WordPress website
Your developer can use the API to build a game catalogue and load free-play games inside your website. You need an HTTPS website and a server-side application. A static HTML page alone cannot safely hold the private API key.
Store that website's API key privately on your server. Use it as a Bearer token and send the registered HTTPS origin with each request.
Fetch the catalogue and build your game pages.
When a visitor chooses to play, request a short-lived launch ticket on your server and display the returned player URL.
Adding a site and reading the catalogue are free. Launching games requires an active plan or valid trial with allowance remaining. Subscription changes do not require a new API key.
Check the connection first
GET SERVICE_ORIGIN/api/v1/connection with the same headers below returns the connected site, current usage and whether launches are enabled. A valid key confirms the connection, not a paid subscription. Never put the API key in frontend JavaScript, a repository or an iframe URL.
Catalogue and usage requests
GET SERVICE_ORIGIN/api/v1/catalogue/batches?limit=50
Authorization: Bearer YOUR_PRIVATE_SITE_CREDENTIAL
X-Rivalless-Site-Origin: https://YOUR_REGISTERED_HOST
GET SERVICE_ORIGIN/api/v1/usage
Authorization: Bearer YOUR_PRIVATE_SITE_CREDENTIAL
X-Rivalless-Site-Origin: https://YOUR_REGISTERED_HOST
The batches API returns at most 100 metadata records per request. Follow next_cursor using the cursor parameter until complete is true and the cursor is null. Save progress after applying each batch; keep filters and the registered site unchanged. This does not use your launch allowance.
Filter and update your catalogue
Use provider, type, theme and game_ids for comma-separated selections. Search with q. Use available_only=1 when selecting new games. For ongoing syncs, omit that flag so unavailable records can update previously imported games; do not create new pages for unavailable records.
Update by stable game ID to avoid duplicates. A fresh sync picks up newly added records and availability changes. Keep the registered site and filters unchanged while following a cursor. Catalogue availability is not a guarantee that a provider will load in every country or on every device. In WordPress, publication follows the import choice, not the API record's review status.
Use /api/v1/catalogue/batches for new integrations. The legacy /api/v1/catalogue endpoint uses a revision checkpoint, not a page cursor.
Usage:GET /api/v1/usage reports the account's used and remaining allowance and period dates. It can return subscription_required when there is no active plan. That does not mean the API key is invalid.
Signed iframe embeds
Your backend requests a launch ticket after the visitor's age and country checks. Put the returned launch_path under your configured service origin in an iframe. This uses the same account allowance as the plugin and API.
The age reference must identify a real age confirmation in your application, not a constant claiming everybody is verified. Use a trusted country decision, not a hardcoded country intended to bypass restrictions. The nonce is 16-64 letters, digits, underscores or hyphens. Reuse it only for an exact retry.
Construct and HTML-escape the URL on your server from your trusted service origin and the returned relative path. Tickets expire and are single-use: create them on demand, not at page-build time. Only the registered HTTPS site can frame the player. Static, permanent provider iframe links are not a supported subscription integration.
When a game cannot start
Keep subscription and connection details in your private administration area, not in messages shown to website visitors. Check the response's code, not only its HTTP status.
subscription_required: ask the site owner to activate a plan. Visitors see "This game is currently unavailable." Do not offer a retry that cannot resolve a missing plan.
launch_quota_exceeded (429): the account allowance is used. Show usage and the next period to the owner; use the same neutral unavailable message for visitors. Do not retry automatically.
unauthorized or site_binding_mismatch: check the saved key, registered hostname and HTTPS origin on your server. Do not regenerate a key unless it needs replacing.
Temporary connection failures or service outages: offer a manual "Try again". Do not repeatedly request new tickets in a loop.
An explicit country restriction: explain that the game is unavailable in that country. Do not infer a country restriction from a generic loading error.
A launch session is counted when a ticket is issued, not when a game is verified as loaded. Reuse the same nonce and request data only for an exact retry while the ticket remains valid; a new nonce can create another counted launch. Do not automatically issue another ticket when a provider fails.
