Tinyburg Authproxy

How it works

The proxy signs your requests before forwarding them to Nimblebit, so you never touch salts or hashes. Authenticate with an API key as a bearer token:

curl -H "Authorization: Bearer <your-key>" \
     https://authproxy.tinyburg.app/player_details/tt/:playerId

A key carries scopes, one per endpoint family, and its own rate limit. Sign in with your Tinyburg account to provision read-only keys yourself, see the keys you hold, and rotate any that leak.

Use the SDK

This proxy serves the same endpoint definitions that @tinyburg/tinytower-sdk is built from, so a typed TypeScript client comes for free. It decodes save data, friends, gifts, visits and raffles into real types, and it already knows how to aim itself here:

npm install @tinyburg/tinytower-sdk @tinyburg/nimblebit-sdk effect

import { NodeCrypto } from "@effect/platform-node";
import { NimblebitAuth, NimblebitConfig } from "@tinyburg/nimblebit-sdk";
import { TinyTower } from "@tinyburg/tinytower-sdk";
import { Config, Effect, Layer } from "effect";
import { FetchHttpClient } from "effect/http";

const Live = Layer.merge(
    FetchHttpClient.layer,
    NimblebitAuth.layerTinyburgAuthProxyConfig({
        authKey: Config.Redacted("AUTH_KEY"),
    })
).pipe(Layer.provide(NodeCrypto.layerSecureRandom));

const program = Effect.gen(function* () {
    const me = yield* NimblebitConfig.AuthenticatedPlayerConfig;
    const { visits } = yield* TinyTower.social_getVisits(me);
    yield* Effect.log(visits);
});

Effect.runPromise(Effect.provide(program, Live));

AUTH_KEY is the proxy key you provisioned here; PLAYER_ID and PLAYER_AUTH_KEY name the tower you are acting as. Pulled saves come back as gzipped Nimblebit soup — hand them to the SDK's SaveData schema and you get floors, bitizens, missions and friends as ordinary typed values.

Public test keys

Two shared keys exist for kicking the tires. They are rate limited by IP address:

00000000-0000-0000-0000-000000000001   # no scopes

00000000-0000-0000-0000-000000000002   # all read-only scopes

Personal keys are rate limited per key instead, and start at 10 requests a minute. Need write scopes or a higher limit? Reach out on Discord.