Connect a mod manager

Connect through the browser

1. Register your manager.

   The site operator registers a public OAuth client and its HTTPS or loopback callback. No embedded client secret is needed.

2. Open the system browser.

   Send the user to /o/authorize/ with a random state and an S256 PKCE challenge. The user signs in with a CPC Hub account, or Steam or Discord when enabled, then approves the requested permissions.

3. Exchange the code.

   Verify state, then POST the authorization code and original verifier to /o/token/. Access tokens last 15 minutes; refresh tokens rotate.

4. Use the API or create a key.

   Use Authorization: Bearer <token>. If the user approved keys:write, POST to /api/v1/keys/ for a separate key with equal or narrower read/write permissions. Keys do not expire by default. Omit days or send null; set it to 1–90 for an expiring key.

Store credentials in the operating system credential store. Users can revoke the manager and all its keys from their control panel.

Files & versioning

Filter creations with /api/v1/items/?tag=parking. Tag matching ignores case and extra spaces. Discover public tags and their creation counts at /api/v1/tags/; signed-in editors can get existing tag suggestions at /api/v1/tags/suggest/?q=park. Tags become public at 11 visible creations by default. Admins can change this threshold.

Discover categories and accepted extensions at /api/v1/types/. Uploads accept raw .cpbp blueprints and .cpcs scenarios. Blueprint packs, ZIPs, JSON, and other mods are disabled. Native game formats are stored without modification.

Create a draft and upload a game file and at least one screenshot. Uploads return HTTP 202 with a check job; poll /api/v1/items/{id}/upload-jobs/. Files stay private until checks pass. Set status to published when ready, or while checks are pending to publish automatically after they pass. A creation can have up to eight screenshots. Game files allow 15 MB by default; /api/v1/types/ reports the current limit. Each approved release returns a stable ID, version, original filename, size and SHA-256. Download by release ID and verify the checksum before installation.

Download and screenshot URLs redirect to signed storage URLs that expire after five minutes by default. Follow the redirect without forwarding your CPC Hub Authorization header. Keep the application URL and request it again when the signed link expires.

The server checks game-file structure in an isolated VM. Installation paths and game compatibility remain the manager’s responsibility. Archives are never extracted by this server.