Publishing on Poki
Poki blocks every external request a game makes unless it has approved that URL first, and it enforces the block with a Content Security Policy around your build. A multiplayer backend is one of the cases it will approve, but only after a review you request by hand. That review is the whole integration: there is no Poki adapter to install and nothing in your irtio code changes, because what is in the way is a policy, not an API.
The policy is at developers.poki.com/guide/external-resources-policy. Read it before you plan a launch date. This page is what it means for an irtio game.
What is blocked and what can be approved
| Poki’s position | |
|---|---|
| Externally hosted multiplayer servers | Approved case by case, on request |
| Assets from an external CDN, fonts, images, audio | Never approved. Ship them in the bundle |
| In-game chat | Never approved |
| External accounts collecting personal data, email or social login | Never approved |
| Analytics and third-party leaderboards | Case by case |
For an irtio game that means the room connection and the control calls can be approved, and three things have to change if you built them the usual way:
- Chat is out. Room messages between players that render as text to another player are the thing Poki does not allow. Keep your room’s own state traffic; drop the chat surface.
- Accounts are out. irtio identity that only mints an anonymous device identity is fine. Anything that asks a player for an email address, or signs them in with a social provider, is not.
- Nothing loads from a CDN. Bundle
@irtio/clientwith your game rather than pulling it from a script tag, and use relative paths for everything in the build.
The domains to ask for
Ask for the endpoints your build actually uses, not a wildcard, because a narrow list is the one that gets approved quickly. For a hosted irtio project in the default region:
| URL | What uses it |
|---|---|
wss://eu.irt.io | the room connection: joinRoom, joinRelay |
https://irt.io | the control API: quick-match, identity, leaderboards, audience credentials |
Substitute your project’s region label for eu if it is set to another one, and list every region
you serve: wss://us.irt.io and so on. A project on its own domain lists that domain instead. How
a build picks its endpoint, and how a url option overrides it, is in the client reference.
Both entries are needed. The room socket alone is not enough for a game that quick-matches, because the queue is a control-plane call before it is ever a socket.
The steps
- Cut chat and external accounts from the build, and confirm nothing loads from an external CDN.
- Submit the request in Poki for Developers under Settings, then CSP. Give the exact URLs from the table above and a short explanation of what each is for. “Multiplayer game server” and “matchmaking and player identity for that server” is the shape of the answer they are looking for.
- Publish a privacy policy on a live page, link it from inside the game, and have it describe what the external service handles. Poki asks for this as part of the approval and does not supply a template, so it has to be yours. What an irtio game has to describe is what irtio holds for it: the room traffic your game sends, any identity you mint, and any leaderboard rows you write. Identity is the page that says what those are, and your data protection agreement with your own players is a legal document, not a docs page: have it reviewed.
- Wait for the review. Poki decides, and the turnaround is theirs. Nothing in your build or on irtio’s side moves it along, so request early rather than the week you want to ship.
- Re-upload the game after approval. Poki says this is what clears the cache and lets the requests through, so an approved game that still fails is usually a game that was not re-uploaded.
The origins step
Your build is served from Poki’s own domain, and irtio matches allowed origins on scheme, host and
port, so the origin serving your game has to be on your project’s allowed list or the join is
refused before any of the above matters. Poki assigns that origin; take it from the URL your
uploaded game runs on and add it on the dashboard under API keys. Where a
portal serves a build from an origin you cannot predict, * accepts every origin, at the cost of
the protection the list gives your project id.
What this leaves you with
A Poki game is an irtio game with no chat, anonymous identity only, and two approved hostnames. The rooms, the schema, the prediction and the matchmaking are unchanged. Compare that with CrazyGames, which needs code but no approval: an adapter for its invite and instant-multiplayer surface, and no policy in the way of a backend.