Public API & Webhooks – MultiConnect Cloud

Live connection details, from your own code

Servers come and go as you scale and redeploy. The Public API tells your game clients and backend services exactly where to connect right now, and webhooks tell you the moment anything changes. Every request is signed with HMAC-SHA256.

How It Works

01 Create an access key

In the dashboard, create an access key and attach it to your deployment. You receive a key and a secret.

02 Sign the request

Build the string key:timestamp:nonce:path and sign it with your secret using HMAC-SHA256.

03 Call the endpoint

Send a POST request with four headers: X-MC-Key, X-MC-Timestamp, X-MC-Nonce and X-MC-Signature.

04 Connect

Receive the current address, port, transport and health of your servers.

Endpoints

Connection details for API, website and database deployments (URLs, hosts, ports and connection strings) are shown in the dashboard and change only when you change them.

Method	Endpoint	Returns
POST	/api/PublicNew/ServerDeployments/GetConnection	The one server a client should connect to the master (master-worker mode) or the combined server optionally in a preferred region.
POST	/api/PublicNew/ServerDeployments/GetCombinedServerInfo	All combined servers, by region and build version.
POST	/api/PublicNew/ServerDeployments/GetMasterServerInfo	All master servers, by region and build version.
POST	/api/PublicNew/ServerDeployments/GetWorkerServerInfo	All worker servers, optionally only those reporting to one master region.
POST	/api/PublicNew/ServerDeployments/ReleaseRetiringContainers	Ends the drain period early for old servers you know are empty, stopping their charges sooner.

HMAC-SHA256 signatures

Every request is signed with your secret. The secret itself is never sent.

Replay protection

Timestamps must be within 5 minutes of server time, and each nonce can be used only once.

Client-distributable keys

Mark a key as client-distributable to ship it safely inside a game build. It can only read connection details it can never deploy, change or spend anything.

Rate limited

60 requests per minute per IP address.

Scoped to a deployment

A key works only for the deployments it is attached to. Each deployment can have up to 5 keys, so you can rotate them without downtime.

Built for security

Code Example

Python - where should this client connect?

import hmac, hashlib, uuid, datetime, requests



KEY = "your-access-key"
SECRET = "your-access-secret"
BASE = "https://api.multiconnectcloud.com"
PATH = "/api/PublicNew/ServerDeployments/GetConnection"

timestamp = datetime.datetime.now(datetime.timezone.utc).strftime("%Y-%m-%dT%H:%M:%SZ")
nonce = uuid.uuid4().hex

payload = f"{KEY}:{timestamp}:{nonce}:{PATH}"

signature = hmac.new(SECRET.encode(), payload.encode(), hashlib.sha256).hexdigest()

response = requests.post(

    BASE + PATH,

    headers={

        "X-MC-Key": KEY,
        "X-MC-Timestamp": timestamp,
        "X-MC-Nonce": nonce,
        "X-MC-Signature": signature,

    },

    json={"deploymentId": "your-deployment-id"},

)

data = response.json()

if data["status"] and data["connection"]:

    c = data["connection"]

    print(f"Connect to {c['ip']}:{c['port']} over {c['transport']} in {c['region']}")

else:

    print(data["message"])

C# (.NET / Unity)

var key = "your-access-key";
var secret = "your-access-secret";
var path = "/api/PublicNew/ServerDeployments/GetConnection";

var timestamp = DateTime.UtcNow.ToString("yyyy-MM-ddTHH:mm:ssZ");
var nonce = Guid.NewGuid().ToString("N");

using var hmac = new HMACSHA256(Encoding.UTF8.GetBytes(secret));

var signature = Convert.ToHexString(
    hmac.ComputeHash(Encoding.UTF8.GetBytes($"{key}:{timestamp}:{nonce}:{path}"))).ToLowerInvariant();

var request = new HttpRequestMessage(HttpMethod.Post, "https://api.multiconnectcloud.com" + path)
{
    Content = JsonContent.Create(new { deploymentId = "your-deployment-id" })
};

request.Headers.Add("X-MC-Key", key);
request.Headers.Add("X-MC-Timestamp", timestamp);
request.Headers.Add("X-MC-Nonce", nonce);
request.Headers.Add("X-MC-Signature", signature);

var response = await httpClient.SendAsync(request);

Node.js - list all worker servers

const crypto = require('crypto');

const key = 'your-access-key';
const secret = 'your-access-secret';
const path = '/api/PublicNew/ServerDeployments/GetWorkerServerInfo';

const timestamp = new Date().toISOString().replace(/\.\d{3}Z$/, 'Z');
const nonce = crypto.randomUUID();

const signature = crypto.createHmac('sha256', secret)
  .update(`${key}:${timestamp}:${nonce}:${path}`)
  .digest('hex');

const response = await fetch('https://api.multiconnectcloud.com' + path, {

  method: 'POST',

  headers: {
    'Content-Type': 'application/json',
    'X-MC-Key': key,
    'X-MC-Timestamp': timestamp,
    'X-MC-Nonce': nonce,
    'X-MC-Signature': signature,
  },

  body: JSON.stringify({ deploymentId: 'your-deployment-id' }),

});

const data = await response.json();

for (const s of data.containers) {

  console.log(`${s.region} ${s.role} ${s.ip}:${s.port} healthy=${s.isHealthy}`);

}

NOTE: Always check the “status” field in the response. Errors are returned with “status”: false and a readable “message”.

Webhooks: be told, don't poll

Add a webhook URL to your deployment and MultiConnect sends a signed POST request whenever your infrastructure changes. Deliveries are retried automatically if your endpoint is unavailable.

Servers added, removed or moved (master, worker and combined)
New build generation live, old generation draining and retired
Instances becoming healthy or unhealthy
Deployment stopped, started or deleted
Operations that failed
Database connection changes, such as a failover

Use Cases

When to Use the Public API

Game clients

Ask for the best server in the player’s region at login instead of hardcoding addresses.

Master servers

Keep an up-to-date list of workers to place players on, driven by webhooks.

Backend services

Resolve server addresses at start-up and after every redeploy.

DevOps scripts

Check that your fleet is running and healthy from your own tooling.

Frequently Asked Questions

Everything you need to know about MultiConnect Cloud.

Is it safe to put an access key in my game client?

Yes, if you mark the key as client-distributable. Such keys can only read connection details. Never ship a normal (non-distributable) key inside a client.

What happens to my servers' addresses when I redeploy?

New servers get new addresses. GetConnection always returns servers from the current build, and webhooks tell your master server as changes happen.

My request says the timestamp is outside the window. Why?

The calling machine’s clock is more than 5 minutes off. Sync its clock and send the timestamp in UTC ISO 8601 format, for example 2026-01-15T10:30:00Z.

Live connection details, from your own code

How It Works

01

Create an access key

02

Sign the request

03

Call the endpoint

04

Connect