Nakama runtime authority
Checks whether a server command is allowed by the game, not merely whether the caller is signed in. It uses trusted identity and ownership rules even when server code has broad storage privileges.
nakama-runtime-authority
See how it helpsWhen is it useful?
Use it when writing custom RPCs or handlers that can mutate player-owned or trusted game data.
What does it help you do?
- Uses validated runtime identity rather than submitted player identifiers.
- Defines request schemas and game-specific ownership checks.
- Recognizes privileged server storage bypasses and bounds handlers.
Try asking this
Build an equipment-change RPC for our RPG. Submit another player’s ID, an unowned weapon and an oversized request. Resolve the caller from the server session, validate ownership and allowed slots, and leave inventory unchanged when any check fails.
Detailed documentation
Read the skill’s original instructions, examples and checks in their authored language.
Show less
Nakama — runtime authority
Use when implementing Nakama RPCs, runtime hooks or authoritative game commands.
Version and project gate
Inspect Nakama server and client SDK versions, chosen Go/TypeScript/Lua runtime, compiled module deployment, database topology, match handlers, RPC registrations, auth/session handling, storage collections and permission rules. Never turn a task into an engine upgrade without the user’s intent. Read the version-matching official reference when an API decision depends on it.
Work
Derive identity from the validated runtime context. Define an explicit request schema and game-rule authorization for each operation. Distinguish privileged server storage access from client permissions. Keep handlers bounded and return stable domain outcomes without exposing internal secrets.
Deliver
A command/auth contract and focused runtime handler with documented failure outcomes. Keep the change in the existing project structure; separate actual observations from the proposed acceptance scenario below.
Failure to prevent
Server runtime code bypasses ordinary storage access restrictions, so it must perform its own ownership and domain checks.
Acceptance scenario
Invoke the command as another user, send malformed fields and replay a completed operation without changing another player’s state. Follow the project’s execution and verification permissions. If execution or a target device is unavailable, provide the reproduction steps and name the remaining uncertainty; do not mark it passed.
Scope and sources
This skill belongs to Kairo. Agent selection is restricted by Orqestria’s assigned-agent policy, including forced skill selection; instruction text alone is not an access control. These are original task workflows researched from official documentation, not a copied or endorsed vendor skill.
- https://heroiclabs.com/docs/gameplay-multiplayer-server-multiplayer/
- https://heroiclabs.com/docs/nakama/concepts/storage/permissions/
Task-specific official references
Included files 1
SKILL.md