GitHub

Player data in three requests.

A simple JSON API for Mobile Legends. Log in with an in-game code, then read profiles and friends.

Read the docs GitHub
  1. 1Send code
  2. 2Log in
  3. 3Profile

Try it with your account

Enter your Game ID and Server ID. A 4-digit code arrives in your in-game mail.

From code to data

Players prove they own an account with a short code from their in-game mail. You never handle a password.

  1. Send the code

    Call /send-code with the Game ID and Server ID. The code arrives in their in-game mail.

  2. Log in

    Call /login with the code. You get a session token back. Each code works once.

  3. Fetch data

    Pass the token to /profile or /friends. If it has expired, repeat steps 1 and 2.

const API = 'https://YOUR-DOMAIN/api';
const post = (path, body) =>
  fetch(`${API}${path}`, {
    method: 'POST',
    headers: { 'Content-Type': 'application/json' },
    body: JSON.stringify(body),
  }).then((r) => r.json());

await post('/send-code', { roleId: 123456789, zoneId: 1234 });
// codes can start with 0, so send vc as a string
const { data } = await post('/login', { roleId: 123456789, zoneId: 1234, vc: '5678' });
const profile = await post('/profile', { token: data.token });
console.log(profile.data.name);

Endpoints

Every endpoint is a POST with a JSON body. Responses are { "success": true, "data": ... } or { "success": false, "error": "..." }.

POST /api/send-code

Send a login code

Sends a 4-digit verification code to the player's in-game mail. A new request cancels the previous code.

FieldDescription
roleIdnumberPlayer's Game ID
zoneIdnumberPlayer's Server ID
POST https://YOUR-DOMAIN/api/send-code
Content-Type: application/json

{
  "roleId": 123456789,
  "zoneId": 1234
}
Response 200
{ "success": true, "data": { "sent": true } }

Try it


        


        

          POST /api/login
          
Exchange code for a token

          
Returns the player's session token. Treat it like a password: keep it server-side, because it grants access to their session until it expires.

          
FieldDescription

            
roleIdnumberPlayer's Game ID

            
zoneIdnumberPlayer's Server ID

            
vcstringThe code from in-game mail. Send it as a string, it may start with 0.

          

            

              
              
            

            


POST https://YOUR-DOMAIN/api/login
Content-Type: application/json

{
  "roleId": 123456789,
  "zoneId": 1234,
  "vc": "5678"
}



          
Response 200


{
  "success": true,
  "data": { "token": "eyJ...", "roleId": 123456789, "zoneId": 1234 }
}

          
Try it

            

            

        


        

          POST /api/profile
          
Player profile

          
Returns the player's name, avatar, level, rank levels and registration country.

          
FieldDescription

            
tokenstringToken from /login

          

            

              
              
            

            


POST https://YOUR-DOMAIN/api/profile
Content-Type: application/json

{
  "token": "eyJ..."
}



          
Response 200


{
  "success": true,
  "data": {
    "name": "Aqua.",
    "avatar": "https://akmpicture.youngjoygame.com/...",
    "level": 127,
    "rankLevel": 71,
    "historyRankLevel": 276,
    "country": "DZ",
    "roleId": 230323021,
    "zoneId": 4052
  }
}

          
Try it

            

            

        


        

          POST /api/friends
          
Friend list

          
Returns the player's friends. Names and avatars only, IDs are hashed upstream.

          
FieldDescription

            
tokenstringToken from /login

          

            

              
              
            

            


POST https://YOUR-DOMAIN/api/friends
Content-Type: application/json

{
  "token": "eyJ..."
}



          
Response 200


{
  "success": true,
  "data": { "friends": [ { "name": "Player", "avatar": "https://..." } ] }
}

          
Try it

            

            

        

      

    


    
Match history is not available yet.
      
The community Rone Arena match endpoints are switched off upstream, and no equivalent has been confirmed on Moonton's web API. It will be added once a working source is verified.

  






  

    

      
Errors and limits

      
Failures always return success: false with a readable error. When Moonton rejects a request, its code is passed along as upstreamCode.

    

    

      

        
Your side

        

          
400
A field is missing or invalid.

          
401
The code is wrong or expired, or the token is invalid. Log in again.

          
404 405
Unknown route, or the request was not a POST.

          
429
Rate limited. Wait for the time in the Retry-After header.

        

      

      

        
Moonton's side

        

          
502
Moonton rejected the request or changed its API.

          
504
The game service could not be reached.

        

      

    

    

      

        
Limits

        
    
          
  • Best-effort per-IP limits: 30 requests a minute on data endpoints, 10 on /login, 5 on /send-code.
    • 
          
  • CORS is open so browsers can call the API, but prefer your backend so tokens stay off the client.
    • 
        

      

      

        
Privacy

        
    
          
  • Requests are proxied statelessly. Codes and tokens are forwarded to Moonton and never stored or logged here.
    • 
          
  • This is an unofficial service. The endpoints it wraps are internal and can change or go offline without notice.
    • 
        

      

    

  






  

    
Build something players love.

    Follow on GitHub