Developers
The board game API that actually exists
Your club’s events, members, collection, stats and campaigns as clean REST — documented in OpenAPI, mirrored as llms.txt for coding assistants, and served over MCP so an AI agent can call it directly.
The surface
The console
One page: key, docs, sign-in
Generate an organization-scoped key (ldy_-prefixed, easy to grep for in a leaked config), read the reference, hand your coding assistant the whole API as one paste — the console is built for how integrations get written in 2026.
- Scoped by design. The key is the organization — every endpoint operates on that group automatically.
- AI-assistant native. “Copy instructions for your AI assistant” exports the API as one prompt; your key is never included.
- Revoke in one tap. Created and last-used dates on the key, and a revoke button next to them.
What the key unlocks
Endpoints that map to the real product
Reads and writes over the same objects the app itself uses.
Events — read & write
List, create, update, publish, cancel; sub-events included.
Participants & members
Add attendees, change attendance, page through the member list with roles.
Collection
The group shelf with ownership, player-count and list filters, BGG metadata included.
Stats
Totals, top players, per-count, per-location and per-game breakdowns for any period.
Campaigns
Read and write campaigns, their members and sessions.
Search
Resolve users and catalog games to IDs before writing.
Sign in with Ludoya
Your website’s login, our OpenID Connect
The same console turns the organization into a standard OIDC provider: Discourse, WordPress or anything that speaks OpenID Connect gets “Sign in with Ludoya” from an issuer URL, a client ID and a secret.
- No user database to run. People log into your site with the account they already have.
- Membership stays in step. Approving the sign-in joins them to the group (or files a join request), so /members reflects your site.
- Users stay in control. Every connection is visible and revocable under Settings → Connected apps.
MCP
Point an agent at it and stop writing glue
Assistants that speak the Model Context Protocol connect straight to /public/v1/mcp with the same key — read-only by default, with a separate /mcp/write endpoint for agents allowed to change data. llms.txt serves the ones that just read docs.
- Read and write, separated. The permission boundary is in the URL, not in a prayer.
- Same objects, same scoping. MCP tools cover the REST surface; the key scopes everything to your organization.
- llms.txt for the rest. Coding assistants without MCP get the whole API as structured text at one URL.
Getting started
From key to first response
Generate the key
Your organization page → API. Business plan feature; the key is scoped to the group.
Curl something
GET https://api.ludoya.com/public/v1/events with X-Api-Key: your key. Future events, paginated, JSON.
Build the real thing
Website event widgets, a Discord bot, an attendance dashboard, your club’s WordPress — or hand the llms.txt to your assistant and describe what you want.
What it costs
The Public API — key, REST, MCP, OpenID Connect sign-in — ships with the Business plan, priced on the public pricing page. Rate limit 100 requests/minute per key.
The WordPress plugin and the in-app developer guides are included; the endpoint reference is public so you can evaluate the surface before paying for anything.
“Board game API” used to return nothing useful
Now it returns JSON. Scoped key, three doc formats, MCP included.
Frequently Asked Questions
Who is the API for?
Organizations — clubs, venues, festivals — that want their Ludoya data on their own website, bots or automations. The key is generated by a group admin and scoped to that group.
What can I read and write?
Read: events (with sub-events and participants), members, locations, collection, stats, campaigns, plus user and game search. Write: create/update/publish/cancel events, manage participants, invites, and campaigns with their members.
How does authentication work?
One header — X-Api-Key: ldy_… — against https://api.ludoya.com/public/v1. Keys are 36 characters with a fixed prefix so they are easy to scan for; treat them like passwords, keep them server-side, revoke from the console if leaked.
What exactly is the MCP endpoint?
A Model Context Protocol server over the same surface: connect an MCP-capable assistant to /public/v1/mcp with your key for read-only access, or /public/v1/mcp/write to allow mutations. The split means you decide whether an agent can change data by choosing the URL.
Is there an OpenAPI spec?
Yes — /public/v1/openapi.json, generated from the same spec registry that renders the docs and the MCP tools, so the three never drift apart. llms.txt at /public/v1/llms.txt serves the same content shaped for language models.
What are the limits?
100 requests per minute per key; exceeding it returns 429 with a Retry-After header. Timestamps are ISO 8601, timezones are IANA strings.
Can people log into my site with Ludoya?
Yes — standard OpenID Connect from the same console: issuer URL plus client credentials works with Discourse, WordPress and anything generic-OIDC. Sign-ins link people to your organization according to your join policy.