Managing your account

Keys, origins, colleagues, game licensing, result webhooks, prices, usage and an audit trail — all of it self-service, in the partner portal.

Where, and how you get in

https://peritusgames.com/portal — the same address for every partner, authenticated by Google sign-in, not your API key.

Google sign-in is the only way in today. No password, no SAML or OIDC federation — every colleague needs a Google account on the invited address. Tell us first if yours can’t.

We create your account, its first licensed games, and your first admin by hand, and send an invite link redeemable only by the address it was sent to — holding it alone is no use to anyone else. Once claimed, that account administers yours directly; there is no second, more privileged door.

Roles

An Admin can only grant a role at or below their own. The last remaining Admin can never be removed or demoted.

What your players pay

Pricing sets your entry price per tier, per environment — the number on the tier card, Admin’s alone to set.

Each row shows the prize, our minimum, and today’s charge; anything above the minimum you keep. An empty field is not zero and not “off” — it charges our minimum, a complete, working configuration. Saving replaces the whole set for that environment; test and live stay separate.

Your rake split is not here — it is agreed with us and shown on Overview.

Inviting a colleague

Name an address and a role on the Members page; the portal hands you a copyable claim link. Each colleague enrols their own second factor the first time they take an action that needs one — a member with nothing enrolled yet is the normal state for someone new.

A domain rule, if your account has one recorded, refuses an outside address at invite time rather than at claim time. An account without one can record its first rule from the same page; changing or clearing a rule already recorded goes through us.

The second factor

Before an Admin or Developer can create a key — test included — they enrol an authenticator app (standard TOTP) the first time it’s needed. A correct code opens a two-hour window for most gated actions, fixed from that code — a long session asks again partway through.

Gated actions come in two levels, by whether the action can be undone:

• Anything that mints a credential needs a code from the last five minutes — creating a key, rotating one, reactivating a stopped account, setting or rotating a webhook, and replacing an authenticator. A key cannot be un-minted, and a webhook secret is shown once.
• Everything else rides the two-hour window — revoking a key, changing origins, setting tier prices, inviting or removing a member, changing a role, recording the domain rule, and licensing a game in test or requesting live access.
  Switching webhook delivery off needs no code at all, like the emergency stop.

Five wrong codes in a row lock further attempts for 15 minutes, logged to the event log. Moving to a new authenticator while the old one still works is self-service; losing the device outright goes through us, identity-proofed.

The emergency stop

Any Admin or Developer can deactivate the account in one action, with no code prompt. The worst an attacker holding a session can do with this button is take the account offline.

It stops every match, key and embed for the account — including calls made with a session token a player's browser already holds, which is what makes it stronger than revoking a key. It takes effect within 60 seconds, and up to 10 minutes if our registry is having trouble being read. There is no instant case. Reactivating needs both an Admin role and the second factor. Origin changes propagate on this same window — see Embedding a game.

The usage meter

Per game, how many matches counted toward your account: a rolling 30 days, through yesterday (UTC) — the window the portal draws, not the window we keep. Daily figures are retained in full, and an invoice is built from them.

• The meter follows your key — a live key answers with your billable numbers, a test key with the sandbox’s. To watch a number move while testing, use the results feed instead.
• “Through yesterday” is not a display lag. A match is folded in once it is decided, visible here within a couple of minutes of finishing — so today's figure would change while you looked at it.
• One match adds one, however many of your players were in it: two of your own players against each other is one match, not two.

Any older period is a call, not a request to us. GET /partner/usage?from=&to= answers the same daily rows for any range you name, with your API key:

from and to are both required, inclusive, and yyyymmdd in UTC. A single call may span up to 366 days. One row per gameId and day that had at least one match; a day with none was never written. matches counts one per match, however many of your players were in it.

The rows are scoped to the environment of the key you used — a live key gives billable numbers, a pgs_test_ key the sandbox’s, with the same couple-of-minutes lag. To check whether a match happened at all, read the results feed instead.

A day is final only once it is over — to may be no later than yesterday (UTC). A wider span is refused, not shortened, and names the limit. Errors and limits gives the rule and the code.

The event log

Six months of every sensitive thing that happened to the account: keys created, rotated or revoked; origins added or removed; members invited, accepted or removed; roles changed; step-up completed or locked out; games licensed in test; live access requested or withdrawn; the account stopped or reactivated.

It includes actions we took on your account, not only your own team's — deciding a live-access request, granting licensing directly, revoking a key, removing a member or resetting their second factor, renaming the account, or changing your domain rule — attributed to the platform, never to a name on your team. If something changed and nobody on your side recognises it, look here before asking us.