Permissions & Scopes

Effective Date: October 15, 2026

This page lists every permission Blazium Games asks for, why we need it, and what we will never do with it. It sits alongside our Privacy Policy, Subprocessors, and the API disclosures for GitHub, X, Discord, and Steam.

Linked accounts and sign-in

You can link GitHub, X, and Discord from Linked accounts and then use any of them to log in.

• Signing in with GitHub, X, or Discord always continues on Blazium Games. A provider proof alone does not log you in.
• If the service is already linked, you enter your password, then an authenticator code if you have set one up, or an emailed code if you have not. You can send another emailed code 30 seconds after the last one. A remembered browser does not skip this step.
• If it is not linked and a verified GitHub or Discord email matches an existing account, you enter that account's password. A match links the service. A wrong password links nothing and creates nothing.
• If it is not linked and there is no matching verified email, you set a username, email, and password, confirm a code sent to that inbox, then set up an authenticator app or skip it and confirm another emailed code. X does not provide an email, so that path always starts with the email you type. The account is created only after the inbox code matches.
• Linking while you are already signed in, at Linked accounts, only attaches the service. It does not create an account.
• Once you unlink an account, it can no longer be used to log in.
• If your account has no password, you must keep at least one account linked.

GitHub

Scopes requested: read:user and user:email.

Why we need it

• To link GitHub to your account and let you log in with it.
• We read your GitHub user ID, login, and your primary email address. A verified email is compared with existing accounts during sign-in and can be shown on the create form. We do not store it on its own. If GitHub does not report a verified email, you type an email instead. Sign-in and linking still continue.

What we store

• Your GitHub user ID and login, so we can recognize the linked account and show which one is linked.
• The GitHub access token is used once during sign-in or linking and is never stored.

We will never

• Write to your repositories, issues, or any other GitHub data.
• Act on GitHub on your behalf.
• Ask for more scopes without updating this page first.

Details: GitHub API disclosure.

X

Scopes requested: users.read and tweet.read. X requires tweet.read alongside users.read to read your profile; we do not read your posts.

Why we need it

• To link X to your account and let you log in with it.
• We make one request to X's /2/users/me and read your X user ID and username. X also returns your display name, which we ignore.

What we store

• Your X user ID and username. Nothing else.
• The X access token is used once during sign-in or linking and is never stored. We do not request offline access, so we get no refresh token.

We will never

• Post, like, repost, follow, or send messages on X for you.
• Read your posts, timeline, or direct messages.
• Ask for more scopes without updating this page first.

Details: X API disclosure.

Discord

Scopes requested: identify and email.

Why we need it

• To link Discord to your account and let you log in with it.
• We make one request to Discord's /users/@me and read your Discord user ID and username. If Discord marks your email verified, we compare it during sign-in and do not store it on its own. An unverified or missing email is ignored.

What we store

• Your Discord user ID and username. Nothing else.
• Discord includes your email address, display name, and avatar in its reply. We do not store the email, and we do not copy the display name or avatar. A verified email is compared during sign-in only.
• The Discord access token is used once during sign-in or linking and is never stored.

We will never

• Join servers, read your servers or messages, or send messages for you.
• Ask for more scopes without updating this page first.

Details: Discord API disclosure.

Steam

Steam sign-in uses OpenID 2.0, which has no scopes and gives us no access token.

Why we need it

• To link Steam to your account, so games that use Steam auth verification can tell their servers which Blazium Games account you are. Steam cannot be used to log in here.
• Steam returns your Steam ID, and we ask Steam to confirm the reply is genuine. We may then read your public Steam name.

What we store

• Your Steam ID and public Steam name. Nothing else.

We will never

• Read your Steam library or friends list.
• Read your Steam inventory, or change it, except to grant an item you asked to move to Steam for a game whose developer turned transfers on.

Details: Steam API disclosure.

MCP access (OAuth)

AI tools such as Cursor, VS Code, and Claude Code connect to one of two Blazium Games MCP servers. The developer server at https://mcp.blazium.games/mcp manages your games. The player server at https://mcp.blazium.games/player acts for you as a player. When you approve a tool, it gets a token for one server only, with one or more of that server's scopes. A token never holds scopes for both servers, and neither server accepts the other's tokens or keys.

Why we need it

• So your AI tool can manage your store pages and read your game's data without you pasting passwords.

How it is limited

• The consent screen has a Read-only access option. Tick it and the tool only gets mcp:read (or player:read); any attempt to change data is refused.
• On the developer server you can pick a narrower preset on the consent screen (store page, CI, crash triage, keys, money, or read-only), so the tool only gets the scopes that job needs.
• On the player server the tool can't buy unless you tick Allow purchases.
• Over MCP, rotating or creating MCP and deploy keys, deleting a deploy key, promoting a build to stable, deleting a game or build, creating more than 100 game keys at once, and adding a project admin wait until you approve them by the emailed link or code, even with full access.
• A token is either for your whole account or for a single game (project). A project token is refused (error 4030) for any other game and for account-level actions: your profile, balance, wallet, library, account analytics, MCP keys, creating games, and buying.
• Access tokens last 1 hour. Refresh tokens last 30 days from when you approved the tool. Each refresh issues a new refresh token and the old one stops working; if an old one is used again, the whole chain is revoked and the tool has to ask you again. All of them stop working if your account is deleted.
• Every request made with an MCP key or token is recorded in an audit log (key, game, method, and path).

We will never

• Accept a read-only token for a change.
• Share your keys or tokens with third parties.

Agent spending

AI tools connected through MCP can buy games and send donations for you, but only if you allow it.

How it is limited

• Every agent starts on Ask me each time: each purchase or donation waits until you approve it by the emailed link or code. Each MCP API key and each OAuth-connected app is a separate agent with its own setting.
• At MCP settings you can let an agent spend on its own: unlimited, or up to a monthly, yearly, or one-time limit (up to $1,000, UTC periods). Anything beyond the limit waits for your approval. Agents cannot change their own limits.
• An approval covers one purchase, for the amount shown, and expires after 30 minutes.
• The limit counts each purchase's total, including tax. Refunded purchases stop counting.
• Buying needs a player token with player:buy, or until October 28, 2026 a developer token with mcp:write for your whole account. Read-only and single-game (project) tokens can never buy (error 4030).
• From October 28, 2026 the developer server no longer buys: its buying tools are removed and direct requests get error 4034. Use the player server instead.
• Agents pay only from your account balance, never by card. They cannot request refunds.
• Your email must be verified before agents can buy.
• Each agent purchase is recorded with the agent that made it, and shows in your wallet transactions and library.

We will never

• Let an agent charge your card.
• Let an agent spend beyond the limit you set without your approval.
• Let an agent send your earnings anywhere except the payout account on your own account.

Agent payouts

AI tools with wallet access can set up payouts and cash out for you without asking first.

• Wallet access means a player token with player:buy, or a developer token with mcp:write or mcp:money. Read-only and single-game (project) tokens cannot.
• An agent can start payout setup and open your Stripe payout dashboard. Both return a Stripe link for you to open: identity, tax, and bank details are entered by you on Stripe's own pages and never pass through the agent or us.
• An agent can cash out your available earnings ($25 minimum, same fees as the website). The money only goes to the Stripe account linked to your Blazium Games account.
• We email you after every cash-out an agent makes, with the amount and the agent's name.
• Your email must be verified before agents can set up payouts or cash out.
• A payout can take up to 72 business hours to reach your bank.
• To stop an agent, revoke its key or disconnect it at /settings/mcp.

Keys

• MCP keys (account keys and project keys) are shown once when you create them and are stored only as a hash. You can rotate them at /settings/mcp or on a game's MCP tab; rotating invalidates the previous key.
• Player keys (starting bgames_play_) work only on the player server. They are shown once, stored only as a hash, and rotated at /settings/mcp separately from MCP keys.
• Deploy keys let the chauffeur CLI or CI upload builds and debug symbols for one game. Issuing a new deploy key invalidates the previous one.
• Steamworks Web API keys that developers enter to import a game from Steam are used for that import and discarded. With Steam auth verification on, the key is stored encrypted, never shown again, and never available to AI agents.
• Steam auth keys (128 characters) sign a game's Steam session tokens and let its servers call Blazium Games. They are stored encrypted, can be shown to the game's owner and admins on its Steam tab, and are never available to AI agents. Making a new one revokes every session token.

Cookies

Sign-in cookies are always on because the site does not work without them. They are HTTPS-only, hidden from page scripts, and SameSite=Lax, so other sites can't make signed-in requests with them. Cookies whose names start with __Host- belong to the exact host that set them: no other blazium.games site, including people's profile and project sites, can read or replace them. Analytics cookies are only set if you accept them in the cookie banner.

Game pages also keep a visit session ID in your browser's session storage. It is cleared when you close the tab.

You can change your choice at any time with Cookie settings in the site footer. Declining removes the Google Analytics cookies.

Revoking access

• Linked accounts: unlink GitHub, X, or Discord at /settings/connections. An unlinked account can no longer log in. If you have no password, the last linked account cannot be removed until you set one or link another.
• Removing Blazium Games in the other service's settings does not unlink it here. Unlink it at /settings/connections to stop it logging in.
• GitHub: remove Blazium Games under GitHub > Settings > Applications > Authorized OAuth Apps.
• X: remove Blazium Games under X > Settings > Security and account access > Apps and sessions.
• Discord: remove Blazium Games under Discord User Settings > Authorized Apps.
• Steam: OpenID gives Blazium Games no ongoing access, so there is nothing to remove on Steam. Unlink it at /settings/connections.
• Agent spending: set any agent back to Ask me each time at MCP settings.
• MCP keys and tokens: rotate keys at /settings/mcp. OAuth access tokens expire after 1 hour and refresh tokens after 30 days; all of them stop working when your account is deleted.
• Everything: email [email protected] to delete your account. See the Privacy Policy.