Skip to main content

Use Palworld REST administration through a private connection

Palworld provides an official REST administration API, but Pocketpair explicitly advises against exposing it directly to the Internet. It can perform powerful operations. Plan a protected connection and the smallest required set of actions before attaching a dashboard, bot or monitoring service.

Confirm support and the management route

Check the API documentation for the installed server release. The current introduction documents enabling REST access and HTTP Basic authentication. Authentication does not itself encrypt traffic or provide per-action permissions. A password-protected public HTTP endpoint can still expose credentials and administrator operations.

Ask support whether this service has an approved private network, authenticated tunnel or restricted management gateway. The game’s public address is not an instruction to publish the REST listener there. An extra panel allocation does not establish network restrictions. Enable the feature only after the protected route is confirmed, and coordinate any required restart.

Begin with server information

Use the documented read-only GET /info operation through the approved route. Confirm the API base path, local forwarding address and authentication details for your installation rather than copying a localhost example onto an unrelated machine. Localhost always refers to the machine making the request.

Use a trusted client that prompts for credentials or reads them from an appropriately protected secret store. Keep passwords out of URLs, shell history, screenshots and exported request collections. Verify the returned server identity and version before testing any write operation. A successful HTTP response from the wrong service is not a successful administration test.

Limit what an integration can do

Decide whether the integration truly needs player lists, settings, saving or shutdown. These have different consequences and privacy impact. Do not give an untrusted browser widget unrestricted administrator credentials. The settings response can reveal operational information, and player responses may contain identifiers that should not appear in public status pages.

Do not assume the native API supplies scoped tokens or separate read-only roles unless the installed release documents them. If an integration needs only health information, ask support for a restricted gateway that permits the specific read-only path and method. Keep the administrator secret server-side, restrict callers and use encrypted transport. A route allowlist must not accidentally include shutdown, kick or other state-changing endpoints.

Test failures and ongoing use

  1. Verify an approved request succeeds from the authorised path.
  2. Verify missing or incorrect credentials fail without disclosing secrets.
  3. Have support confirm the native listener is unreachable from unauthorised public networks.
  4. Use a conservative polling interval and back off after repeated failures. Avoid loops that overload a struggling server.
  5. Log the time, operation and result without logging the authentication header or complete sensitive responses.

Revoke access when the integration is removed, and rotate credentials after accidental disclosure. For troubleshooting, distinguish a route timeout, an authentication rejection and an unsupported endpoint. Keep the server ID, installed version and redacted response; do not post the administrator password to prove that authentication was configured.

Further reading

Looking for another game? Browse game server setup and troubleshooting guides.

No comments to display