Register your service

• A name and an id. The name is what players see on the confirm screen. The id is [a-z0-9_], 2–32 characters, and is what every response calls you.
• Your return origin. The exact origin players are sent back to after confirming — https://app.example.com, compared as a string, so https://example.com is a different one. One per deployment.
• Your start URL. The page on your site that begins the handshake. Trivela puts a button on the player’s account page that points there, so commit to a path you will keep; /link/trivela is the convention. It should sign the player in if they are not, then start.
• What you send, what you read. Two lists of fields from the catalogue. A field not on it yet is a proposal we are glad to have — name, shape, and where it would be shown.

Reach us through the GOALS Pro League community, which is where Trivela is run from.

You get back sk_<id>_<64 hex>, shown once — only its hash is stored. Every call sends it as a bearer token. Issuing a new key revokes the old one at once; revoking stops your API access but does not disconnect any player.

Authorization: Bearer sk_yourservice_…
Content-Type: application/json

Ask for a second registration with a _dev suffix. It has its own key and its own return origin, and Trivela treats the two as the same service where it matters — a value sent from staging is filed as yours, not as a rival’s — while keeping the keys apart so a staging deploy cannot write against production rows.

TRIVELA_SERVICE_KEY=sk_yourservice_…       # absence should disable the feature cleanly, not break a button
TRIVELA_API_URL=https://www.trivela.team
TRIVELA_RETURN_ORIGIN=https://your.origin  # a constant, never derived from the request's Host
TRIVELA_WEBHOOK_SECRET=wh_yourservice_…    # only if you take a webhook — see Staying in sync