Create a vote session
Your backend sends a private player reference and receives a short-lived vote URL.
Create a short-lived vote session from your server, send the player to Toplands, then claim the verified vote exactly once before granting the reward.
A protected flow from your game server to the player and back.
Your backend sends a private player reference and receives a short-lived vote URL.
Your launcher, website or in-game command opens the returned URL in the player's browser.
Toplands applies captcha, eligibility checks and the 24-hour cooldown before recording it.
Your backend validates the result and atomically claims the vote once.
The recommended pattern for a launcher, account panel or in-game vote command.
Use an opaque player identifier. Never send passwords, e-mail addresses or character data Toplands does not need.
/v1/vote-sessionscurl -X POST https://api.toplands.com/v1/vote-sessions \
-H "Authorization: Bearer YOUR_SECRET_API_KEY" \
-H "Content-Type: application/json" \
-d '{"server_id":"srv_aden_01","player_reference":"account_18427"}'The URL may be opened from a launcher button, account panel or an in-game command. The client never receives the secret API key.
window.open(voteSession.vote_url, "_blank", "noopener,noreferrer");Poll only while pending, then stop after completion, expiration or failure.
/v1/vote-sessions/{session_id}{"status":"verified","vote_id":"vote_51ad7b","next_vote_at":"2026-10-22T20:42:18Z","claimed":false}Claiming must be atomic and idempotent. Only a response with claimed: true authorizes the reward.
/v1/votes/{vote_id}/claimClaim at Toplands, save a local reward log, then credit the player.
These rules protect the player and your reward economy.
Never embed a secret in JavaScript, HTML, a launcher executable or the game client.
Send an internal ID or server-generated alias instead of personal information.
A success page is not proof. Trust only the authenticated API response.
Use next_vote_at to show the next eligible time and avoid unnecessary calls.
The dashboard generates the vote URL and embed code with the correct server ID. Secret keys remain separate and server-side.