Integrate Automation //
Everything you need to integrate NERAI manifest automation into your application or workflow. Simple, path-based, and lightning-fast.
Prerequisites & Setup
Before you start hitting the API, please ensure you meet the following requirements to avoid instant HTTP 403 or 400 errors.
Valid API Key required
You must create an API key via your Developer Dashboard. The key must be passed via the Authorization: Bearer YOUR_KEY header on every request.
Base Steam App IDs ONLY
Our engine explicitly blocks requests for DLCs, soundtracks, and invalid App IDs. You must provide the base game's numeric App ID (e.g., 730 for CS:GO).
Active Quota
Depending on your plan, you have a daily request limit (15/day for Free). Generating an existing manifest uses 1 credit, missing upstream requests use 2 credits. Monitor your usage via the /api/{apiKey}/stats endpoint.
>_ Interactive Setup
Set your credentials here to make the "Run Test" buttons below actually execute against your account.
Standard Endpoints
Fast Generate
The primary engine for fetching game manifests. This checks our high-speed cache first. If missing, it immediately attempts upstream providers (like Ryuu or Morrenus).
Request Parameters
Expected Responses
Formal Request
Programmatically request that a game be queued into our passive generation pipeline. If the game is not immediately available, it enters our background async processing queue.
Request Parameters
Expected Responses
Bulk Generate
Queue up to 25 App IDs in one synchronous request. Only available for Reseller plans and higher.
Expected Responses
OnlineFix List
Retrieve a complete list of all currently indexed OnlineFix games, including their filenames and metadata.
Expected Responses
OnlineFix Download
Redirects directly to a presigned R2 download URL for the multiplayer fix by App ID.
Legacy Endpoints (v1)
The old /api/{apiKey}/... generate and request endpoints have been deprecated in favor of our new v2 header-based authentication API.
Important Notice: API Keys created from today (July 5th, 2026) onwards cannot use these legacy generate and request endpoints (they will return an HTTP 666 error). However, the legacy stats and usage endpoints remain fully supported and unblocked for all API keys, including newly created ones.
Legacy Generate
Deprecated path-based generation.
Legacy Request
Deprecated path-based formal request.
GET /API/{APIKEY}/STATS
Supported for all keys.
GET /API/{APIKEY}/USAGE
Supported for all keys.
Legacy Bulk Generate
Deprecated path-based bulk request.
Sentinel Firewall & Limits
| Plan Tier | Daily Quota | Burst Limit | Ryuu / Morrenus | SLA Support |
|---|---|---|---|---|
| Free | 15 / Day | 5 req / 5s | Default | Best Effort |
| Regular | 500 / Day | 30 req / 5s | Off* | Community |
| Premium POPULAR | 1,500 / Day | 50 req / 5s | Off* | Standard |
| Reseller | 30,000 / Day | 75 req / 5s | Off* | Priority |
| Business | 100,000 / Day | 100 req / 5s | Off* | Enterprise |
* Paid tiers ship with upstream off by default; staff can enable Ryuu and Morrenus per account (plan overrides). Free includes both by default.
Sentinel Guard Activated
Automated scraping patterns, high AppID variance, or malicious request payloads will result in a 24-HOUR IP JAIL. Multiple violations will result in permanent hardware and API key revocation.
Admin & Platform Guide
Programmatic API Keys
Create keys from the API Keys page. Send them on every request via the x-api-key: nerai_… header or Authorization: Bearer nerai_…. Quotas are enforced live: each plan tier has a rolling 24h daily limit (Free 50 · Standard 500 · Premium 1,500 · Reseller 30,000 · Business 100,000). Once exhausted, requests return 429 KEY_DAILY_LIMIT with an X-RateLimit-Reset header until the window rolls over. Response headers X-RateLimit-Limit / X-RateLimit-Remaining let clients self-throttle.
7-day lifetime: every key expires exactly 7 days after creation (policy adjustable in Settings → API Key Policy). Expired keys return 401 KEY_EXPIRED — generate a new key, which automatically becomes your stored active key (users.active_api_key_id), so integrations reading “the key on file” keep working with zero manual re-pasting.
Branded responses: every API response carries X-Powered-By: NERAI Gen + X-NERAI-Provider: NERAI. Keyed requests additionally expose X-NERAI-Key-Expires. Error payloads embed provider / docs so SDKs can verify provenance before trusting a response.
Scraping protection: sustained high request rates or high per-app variance are flagged automatically. Repeated violations trigger an automatic Discord ban + account suspension — the user loses the site and every key until unbanned by an admin.
Admin Endpoints
Admin routes authenticate with the x-admin-key header or the Discord session cookie.
Bulk Imports & Discord /addsource
Bulk Git Import mirrors an ENTIRE public GitHub / GitLab repo — every <digits>.lua / .zip and <depot>_<id>.manifest blob is uploaded to R2 and registered in game_files / uploaded_game_manifests so /gen serves them immediately — no per-app setup, 60k+ luas are fine. Runs as a background job with a progress endpoint, dedupes by blob SHA, and preserves existing charon/scan/admin_upload provenance when an app is re-mirrored.
Bulk URL / API Import does the same for plain websites — Apache/nginx autoindex pages, custom directory listings, or JSON endpoints listing file URLs. The crawler follows links (same-host, depth-bounded), extracts URLs from JSON shapes ({url}, {download_url}, {files} arrays), and mirrors everything found.
Both are available from Dashboard → Sources, and admins can trigger a website scrape from Discord with /addsource url:https://example.com/luas/ — the bot starts the job, then edits its reply with a live progress bar until it finishes.
Platform Status
GET /api/stats/status probes every component live — database round-trip, R2 healthcheck, Supabase reachability, Discord gateway ping, Steam API, mirror sync recency — plus a 24h traffic snapshot and platform scale. The /status page renders it with per-component latency and detail.
Online Fix Gen
The /onlinefix page (in the sidebar for everyone) is the public catalog for multiplayer / online fixes. It merges NERAI's own indexed fixes from game_files (file_kind='online-fix') served via GET /api/onlinefix and GET /api/onlinefix/download/:appId, plus the community archive proxy. Search, filter, and download straight from either.
Admins can bulk-index more fixes from the Dashboard → Sources → Bulk URL / API Import tab (preset buttons for Charon Database shards and the full Charon repo), or trigger the same crawl from Discord with /addsource.
Anti-Phishing Security Codes
Every user has a personal GG-XXXX-XXXX-XXXX security code stored in a dedicated vault (user_security_codes), separate from the account row. Every legitimate Nerai Discord DM and dashboard inbox message the bot sends is signed with the recipient's exact code (fulfilment DMs, admin notifications, test DMs). A message missing the code — or showing a different one — is phishing: never click links or reply. Codes regenerate from Settings → Anti-Phishing Code, and a Send Test DM button proves the flow instantly.
Custom Implementation?
Need specific endpoints, bulk-order discounts, or integration assistance? Our architects are available on Discord.