Get started with the API

What the API is #

The Console Client API lets your own code do what you would otherwise click in the dashboard: see which accounts are online, connect and disconnect them, send chat and commands, read chat, run macros, move accounts, work with inventories, and change your connection settings. It is a plain HTTPS and JSON API, so it works from any language that can make a web request.

The API is included with every paid plan, from Tier 1 up, and is currently in beta. You can create up to five API keys in Settings → API, and every request carries one of them. Your plan decides which areas your keys can reach and how fast you can call: see What each plan includes below.

What each plan includes #

The API follows the same tier rules as the dashboard: an area that needs Tier 2 or Tier 3 in the dashboard needs the same tier through the API. The rate limits belong to your account and are shared by all your keys, so five keys never give you five times the limit.

A call to an area your plan does not include answers 403 with tier2_required or tier3_required, and a key whose plan has lapsed answers tier1_required on every call. Upgrades, downgrades and renewals apply from the very next request. GET /me tells your code its tier, limits and areas at any time.

Your first request #

1. Create your key

   Open Settings → API, type a name for the key, such as the script or server that will use it, and click Create key. Click Copy and store the key somewhere safe straight away. It is shown only once. API keys and the IP whitelist covers this page in full.

2. Turn on the IP whitelist

   Recommended. Add the public IP of the machine that will send requests, then switch the whitelist on. A stolen key is useless from any other IP.

3. Check the key works

   Call GET /me with the key in the Authorization header. A 200 response with your plan means everything is set up.

4. List your accounts

   Call GET /accounts. Each account has an id that every other account endpoint uses.

curl https://dashboard.consoleclient.com/api/v1/me \
  -H "Authorization: Bearer cc-api-YOUR_KEY_HERE"

{
  "discordId": "123456789012345678",
  "plan": { "tier": 2, "maxAccounts": 10, "expiresAt": 1792540800000 },
  "rateLimit": { "limit": 60, "windowSeconds": 60, "maxConcurrent": 4 },
  "ipWhitelist": { "enabled": true, "count": 1 },
  "key": { "name": "Sell bot", "hint": "N5VC", "createdAt": 1790000000000 },
  "access": {
    "accounts": true, "chat": true, "macros": true, "settings": true,
    "inventory": true, "look": true, "movement": false
  }
}

Base URL and versions #

Every endpoint in these guides is relative to this base URL:

https://dashboard.consoleclient.com/api/v1

The API is served over HTTPS only. The v1 in the path is the version. New optional fields and new endpoints can appear at any time, so write your code to ignore fields it does not know.

How requests work #

Account IDs #

Every account has an id, returned by GET /accounts. For a Microsoft account it is the email you added it with, for a cookie or token account it is the generated address shown in the dashboard, and for an offline account it is the username. The ID never changes, even when the player name does, so store the ID and not the username.

The ID goes straight into the URL. An @ is fine as it is. If an ID contains a space or another unusual character, URL-encode it the way your HTTP library normally does.

POST https://dashboard.consoleclient.com/api/v1/accounts/[email protected]/connect

Actions are queued, not instant #

Your accounts run on backend servers around the world, and the API hands each action to the server that runs the account. A successful response to connect, disconnect, chat, move, or a macro run means the action was accepted and queued, which normally takes well under a second to reach the account. It does not mean the account is already online or that the server accepted the chat message.

To confirm an outcome, read it back: poll GET /accounts/{id} until status is connected, or watch GET /chat for the server’s reply to a command. Endpoints that read live data from an account, such as the inventory, wait for the account to answer and return the real result.

Keep the key on a server #

Call the API from a server, a bot, or a script you run yourself. Never put the key in a web page, a browser extension, a mobile app, or anything else you hand to other people: whoever can read the code can read the key. The API does not send CORS headers, so browsers refuse to call it from a page by design.

Where to go next #