Concepts
You own the game. Loki owns the platform.
Loki does not compile your source, run a creator backend, or decide whether the game is complete. After install, you still have to make this title playable.
You own the game
The repository, the UI, the rules, the simulation, and the finished browser build are yours. Fine-tuning seats, modes, lobby copy, and feel stays yours after the SDK is in the tree.
Loki owns the platform
Identity, tenant boundaries, membership, invite codes, matchmaking, message sequencing, snapshots, host election, quotas, and the playable origin are Loki’s. Never trust a client-supplied player ID, project ID, room key, or membership list over what the SDK returns.
Finished builds, not servers
Upload game.json, index.html, and static assets. Do not upload source-only repos, server.js, secrets, creator ad tags, or localhost URLs.
The live game runs in a sandboxed iframe on a Loki origin. Production multiplayer is available only from that hosted build.
Host authority
Every Layer 1 room elects a host. The host is a player client. Loki checks that the sender is the current host, sequences messages, and migrates host when that player is gone. Loki cannot prove the host simulated honestly.
Use this for casual and unranked play. Do not treat it as ranked anti-cheat or a server-authoritative competitive boundary.
Two room types
| Room | When | What Loki commits |
|---|---|---|
| Synchronized | Turns, discrete actions, lockstep state | Actions, reducer commits, stateVersion |
| Realtime | Continuous host simulation | Inputs and host snapshots, paced and fenced |
Choose by how authoritative state progresses, not by genre or frame rate. A 60 FPS chessboard is still synchronized.
Layer 1 and Layer 2
Layer 1 is hosting and multiplayer. Private and unlisted links. Friends can play an ugly draft.
Layer 2 is a reviewed public catalog page. It is closed. You cannot publish into the catalog from this release.
Identity
Players authenticate through Loki. Hosted games do that through createHostedLokiClient(). The game must not mint its own player IDs or call the multiplayer runtime with raw platform credentials.