Treasury Licence
More actions
| Jobs |
|---|
 |
| Licences |
| Trades |
| Professions |
| Government jobs |
| Category |
A Treasury licence allows you to use the Treasury API in order to manage your personal and business accounts with external software. This is useful when creating:
- Banks or other financial institutions
- Payments systems for businesses
- Verification systems
- Personalised dashboards
- Applications to manage employee pay
- and much, much more!
What does it do?
 | Using the Treasury API requires knowledge of computer programming. Use of the API by inexperienced players can easily lead to security issues, and is therefore not recommended. |
Using the Treasury API, you can get information about or manage many aspects of the Economy right from your own custom applications. This includes:
- Making payments to businesses or individuals
- Getting the transactions of your personal or business account
- Creating and managing webhooks (which let your system know when a transaction comes in)
- Getting or managing information about your company and employees
- Getting information about other companies, including their balance
- Getting the balance of other players
- Getting information and statistics about chestshops
Implementing these functionalities into your own applications can be very powerful, and can elevate your business to the next level. For example: you can almost fully automate every aspect of a bank.
How do I get started?
| Never share your API key with anyone! |
Once you have obtained the Treasury Licence, you gain access to a command which allows you to generate your own API key. To obtain a key for your personal account, run /treasuryapi personal issue. To obtain one for your business, run /treasuryapi business issue <business name>.
When you run these commands, the API key is shown in chat. It is shown once, so make sure to copy it somewhere safe! You can retrieve it later with /treasuryapi personal/business export <keyId> (it gives you a shareable link to the key), or replace it with /treasuryapi personal/business reissue <keyId>.
With your key in hand, you can get started! Find all information you need on how to use the Treasury API in the Documentation and on Swagger.
Security
The Treasury API is an incredibly powerful tool, but with that also come some risks. Please adhere to the following instructions in order to keep your account secure.
- NEVER share your API key with anyone! Someone with your API key can impersonate you and has full access to the account the key is associated with. They can very easily take all your money, or use your key in a way which is illegal or against the Server Rules.
- Getting help from someone? Consider options that do not require you to give them an API key. For example by having them set everything up on a machine you have access to, revoking their access, and only entering the API key after they no longer have access. Or by using an intermediary business that uses their own accounts.
- In the event that you really do need to give someone API access for your business, make sure they are very trustworthy. Then, add them as a Co-Proprietor to your business so they can generate their own API key to use. That way, transactions and other API calls still lead back to them, not you! But remember: they still have full access to your account.
- Make sure you know what you're doing. If your application has security vulnerabilities, users of your application may be able to do things that you didn't intend for them to. Including possibly draining your account.
- Regularly rotate (change) your API keys. You can do so through the API or the in-game command
/treasuryapi personal/business reissue <keyId>. - If you feel that something is amiss: rotate your keys and always feel free to contact Staff.
- Never commit a key to source control or paste it into a public channel.
- Use a separate key per application so you can revoke one without breaking the others.
- Revoke keys you no longer use.
Unfortunately, in the event that you do give out an API key and get scammed, Staff will not be able to reimburse the damages to you. The same applies if a security vulnerability in your or someone else's application gets abused to drain your account or to do other damage.
Rate Limits, Abuse, Recklessness
Every type of request has a rate limit, which may be different for personal and business API keys. You can find all rate limits on Swagger. Exceeding the rate limits results in a HTTP 429 status code with a Retry-After header (in seconds). If you get this, please back off on the requests and retry later. Persistently exceeding your rate limits or purposefully sending malicious requests to the API may lead to your API access being limited or revoked entirely, as well as to other punishments from the Staff Team.
Staff may also limit or revoke your Treasury API access if you handle your API keys recklessly, including sharing them with others or exposing them publicly. Follow the security guidance above to keep your accounts and applications secure.