Server-authoritative gacha, arena, and coins. The client asks; the gateway decides.
The Game API for POKEISLAND and its official TypeScript SDK. The gateway is where every value that matters is decided or verified: gacha rolls run here with odds locked, the coin ledger lives here, arena matchmaking and rank math run here, and the replay verifier re-runs every submitted battle before touching a rank.
The client is untrusted by design. This repo is the trust boundary.
| Operation | Where it happens | Why |
|---|---|---|
| Gacha roll | Server | Odds locked, logged to gacha_log; client cannot influence rarity |
| Battle result | Re-run via replay verifier | Forged transcripts are rejected (409) |
| Coin credit | On-chain deposit listener | Credited only on confirmed deposits |
| Rank change | Server rank math | Applied only after verification |
| Payout | Isolated signer | No API route can move pool funds arbitrarily |
Full reference: ENDPOINTS.md.
| Group | Routes |
|---|---|
| Auth | POST /auth/wallet |
| Gacha | POST /gacha/open · GET /dex |
| Coins | POST /coins/quote · POST /shop/buy |
| Arena | GET /arena/opponents · POST /arena/attack · POST /arena/defense · GET /arena/ladder |
| Quests | GET /quests · POST /quests/claim |
The @pokeisland/sdk TypeScript client wraps the API with typed methods and session handling.
npm install @pokeisland/sdkimport { PokeIslandClient } from "@pokeisland/sdk";
const client = new PokeIslandClient({ baseUrl: "https://pokeisland.fun/api" });
// Guest play — no wallet required
await client.authGuest();
// Open a ball (server rolls, odds locked)
const pull = await client.gacha.open("ultra");
console.log(`Pulled ${pull.mon.name} (${pull.rarity}★)`);
// Check the live arena pool
const ladder = await client.arena.ladder();
console.log(`Pool: ${ladder.pool.toLocaleString()} $ISLAND — verify at ${ladder.poolWallet}`);See examples/basic-usage.ts for a full flow.
Anon-guest sessions cover collect + battle with no wallet. Wallet sessions (sign a nonce with POST /auth/wallet) unlock deposits, the shop, and the arena. All calls carry Authorization: Bearer <token>.
| Resource | URL |
|---|---|
| Play | https://pokeisland.fun |
| API base | https://pokeisland.fun/api |
| GitHub | https://github.com/pokeislandfun |
| Telegram | https://t.me/pokeisland |