Overview
Explore the direction for games, city experiences and useful services in one connected African world, and see exactly which developer capabilities exist today.
What exists today
| Capability | State | Where |
|---|---|---|
| Developer console: register, create a sandbox app, rotate or revoke secrets | Built. Sandbox only. Switched off in production (answers "feature disabled"). | africaone.io/developers (full account required; guests are refused) |
Public discovery: GET /capabilities, /regions (countries with listed cities, from the reviewed registry) and /status (developer API readiness plus the sanitised public platform status) | Built. Read-only projections of existing public data; no token needed. | API reference |
Client-credentials tokens (300 seconds, scope city.public.read) | Built. Sandbox only. Same production switch. | POST /developer/v1/oauth/token |
User authorisation: authorization code with PKCE, consent screen and receipts, per-app pairwise sub, refresh-token rotation, revocation, GET /me | Built. Sandbox only. Same production switch. | User authorisation guide; POST /developer/v1/oauth/token, /oauth/revoke; players withdraw access in My Account, Connected apps |
| Signed test webhooks to a public HTTPS endpoint, with synthetic sandbox players | Built. Sandbox only. Same production switch. | Console, "Webhooks and sandbox" |
Live webhooks from the platform outbox (consent.granted, consent.revoked), retries with backoff, failed-delivery list and audited replay | Built. Sandbox only. Same production switch. Only the two consent events exist so far. | Console, "Failed deliveries" |
| Versioned API contract (OpenAPI 1.1.0) and a contract mock generated from it | Published. Eight operations: public metadata, city discovery, the OAuth endpoints and the consented profile. Every real and mock response is tested against the document. | API reference; 1.0.0 stays downloadable |
| Production credentials | Closed. The schema only permits sandbox clients until a security review opens production. | — |
| SDKs, rate limiting, signed pagination, game sessions and leaderboards | Not built. | — |
| Commerce, entitlements, regulated assets | Off, and fail closed. | — |
No real player, balance or live location is visible to a sandbox app. Sandbox players are synthetic.
Start with an experience
Choose a useful moment for a player: discovering a city, enjoying a short game, finding a creative activity or sharing a practical skill. Give it one clear purpose, make it work on an ordinary phone, and let the player leave without losing their place.
- Plan your first experience: define the journey, permissions and recovery states before writing an integration.
- AfricaOne Experience Kit: use the product's visual language and accessibility guidance.
The platform direction
| Experience | Proposed capability | Preview status |
|---|---|---|
| City discovery | Reviewed city information and public events | Documentation only |
| Games | Scoped sessions, approved results and leaderboards | Documentation only |
| Creative activities | Reviewed submissions and approved assets | Documentation only |
| Skills and services | Consented profile skills and moderated discovery | Documentation only |
| Recorded agreements | Party-authorized records with clear proof limits | Documentation only |
These are planning categories, not claims that developer endpoints or runtime integrations exist for them. The table above is the complete list of what exists. A player-facing feature does not automatically grant access to external applications.
Trust comes first
Ask only for information needed for the experience. Explain what the player is agreeing to, respect their choices, and make errors recoverable. A third-party experience must never decide a player's balance, ownership, payment status or permission to access another person's information.
Skills a person adds to their profile are self-declared unless a separate, genuine verification process says otherwise. Record integrity is distinct from identity, qualifications, completed work and payment.
What comes next
Read the versioned API contract and download its OpenAPI schema. Open the sandbox console to see the console as it is; in production it reports that the platform is not enabled.
Each further capability will be announced only when it has been reviewed and released, with a versioned reference, scope and consent requirements and release notes. Until then, use these guides to prepare your experience without relying on anything not listed above.