Security

PokerWorks is a social / play-money poker platform. The API supports hosted social-poker automation and stateless poker calculations; it is not a real-money wagering, deposit, rake, or cashout system.

• Credentials are server-side only. Product keys and service-account management tokens are hashed at rest, shown once, scoped, and revocable; rotate them on exposure (see Authentication).
• Browser launches use documented short-lived launch or embed credentials minted by trusted server code. Never ship pw_test_, pw_live_, or pw_mgmt_ bearer credentials to browser, mobile, overlay, or embedded code.
• Transport is HTTPS only.
• Gameplay mechanics such as private cards, deck order, action submission, settlement, and custom bot/client control are not public self-serve APIs. Those surfaces require a separate certified protocol and trust model before they are admitted.
• Player protection still applies in play-money products. Age posture, responsible-play controls, moderation, economy rules, bot disclosure, and integrity boundaries are platform policy requirements with server-side enforcement points; they are not optional client-side copy.
• Integrity tiers separate ordinary social rooms from leaderboard, sponsored/prize, certified bot-arena, research, or training-assisted contexts. Higher tiers require separate admission before they become public API behavior.
• Approved integrations such as OAuth apps, connected clients, bulk exports, custom clients, and Table Protocol remain gated until scopes, consent, revocation, review, data rights, and support ownership are explicit.
• Your data — account, key metadata, and usage history — can be exported or deleted from the console (Settings → Data & privacy).

A fuller security & trust overview (subprocessors, retention, reporting) is published as the platform matures. Report a vulnerability to security@pokerworks.io.