Configuration

Configuration

The API is configured through environment variables plus a small remote config.json loaded at startup.

Environment variables (required)

These are read from the process environment (or a local .env file via python-dotenv). If any is missing, the app prints a CRITICAL ERROR and exits.

Variable	Required	Description
VALID_API_KEY	✅	The master API key. Never expires; accepted by /v1/auth/{apikey} and used by the dashboard by default.
ADMIN_KEY	✅	Secret used to authorize the admin endpoints (sent as the X-Admin-Key header).
DATABASE_URL	✅	PostgreSQL connection string (Neon or compatible). Used for the api_keys table.

Example .env

VALID_API_KEY=Your_Api_Key
ADMIN_KEY=Your_admin_Key
DATABASE_URL=postgresql://user:password@host/dbname?sslmode=require

🔐 Never commit your real .env. It is git‑ignored. Only .env.example (with placeholder values) belongs in the repository.

Optional variable

Variable	Default	Description
CONFIG_URL	A hosted config.json Gist	URL of the runtime config JSON (see below). Override to point at your own copy.

Remote config.json

At startup the app fetches a small JSON document that holds values that change between game updates. This keeps the release version and login endpoint editable without redeploying the code.

Expected shape:

{
  "RELEASEVERSION": "OB53",
  "MAJOR_LOGIN_URL": "https://<free-fire-login-host>"
}

Key	Description
RELEASEVERSION	Sent as the ReleaseVersion header during the MajorLogin call. Must match the current game build (e.g. OB53).
MAJOR_LOGIN_URL	Base URL of the Free Fire login server. The app appends /MajorLogin.

If the config can't be downloaded/parsed, or either key is missing, the app exits with a CRITICAL ERROR. To host your own, point CONFIG_URL at any raw JSON URL (e.g. a GitHub Gist raw link).

Built‑in constants

A few values are defined directly in app.py and normally don't need changing:

Constant	Role
MAIN_KEY / MAIN_IV	AES‑128‑CBC key & IV used to encrypt the login payload.
USERAGENT	Device user‑agent string sent to the login server.
Garena OAuth client_id / client_secret	Identify the guest‑token grant request to connect.garena.com.

Where each value is used

• VALID_API_KEY / database keys → checked in API Reference.
• ADMIN_KEY → checked in Admin API.
• DATABASE_URL → the api_keys table, see Admin API.
• RELEASEVERSION / MAJOR_LOGIN_URL → the handshake, see How It Works.