[API] Using scripts in another GM's game

I signed up as a mentor to get access to scripting, so that I could have improved scripts and macros as a player. I set up a dummy game and a character so that I could debug them and I'm reasonably happy with that. How do I take those scripts into another GM's game? It seems to me that the GM would have to install those scripts into his game, for which he also needs to be a mentor. Or is there a way he can allow me access to the game parameters so that I can install them? Am I missing something obvious? (I'm a n00b after all).

Hi Revdr. API access is a Mentor level feature and is only available as the GM. Player's w/out subscriber benefits can still enjoy the scripts that a Mentor GM has running. I think you could create a game and promote a non-subscriber player as GM.

Unfortunately, the game's already running (and has been for months). The other players would all have to subscribe to port their characters across, because there's no import/export for free accounts. It's a shame if the API feature is useless unless you're the GM. I guess I'll have to cancel/downgrade my subscription.

What you can do is gift a mentor subscription to the GM. If you're planning on staying in their campaign long term.

Revdr said: Unfortunately, the game's already running (and has been for months). The other players would all have to subscribe to port their characters across, because there's no import/export for free accounts. It's a shame if the API feature is useless unless you're the GM. I guess I'll have to cancel/downgrade my subscription. Yes and no..... If you were given control of all the characters in the game, you could add them to your vault, then import them to your campaign. It wouldn't work for any of the other items in the game though. it would also potentially give you a lot more info about the game than a non gm should have so HoneyBadger's suggestion of gifting the subscription to the gm and having them install the scripts is probably the best option.

So, I basically double (or more) my costs? I need to pay to use the API in the first place and then pay again for any game in which I play? While I can see how that's attractive to Roll20, it's not a great proposition as a user. I think the subscription options need to be clear that the API is only usable for games in which you're the GM. I also think that Roll20 need to think a bit harder about how they could monetise more effectively. Right now the only attraction as a player is to get access to the vault and to transfer characters between games, which is only of limited use. $10/month is just about acceptable, so that I could add my own tweaks, but $20/$30/$40 per month isn't. It also puts me off joining any one-shot games, because I'd be shorn of my own utilities in those.

I only suggested that as an option for long term, such as playing in the same GM's campaign for a year or more. Not for every game you play in.

The best thing i could suggest is that you would cancel your own subscription and ask all the players and current GM to chip in for a mentor subscription for the GM. That way you all benefit from the awesome features with only a fraction of the cost... 4 players and a GM at $2 a month each for dynamic lighting and API is WELL worth it. That way you can arrange the same thing for each campaign you are in... or run one yourself in the future :) Takes a bit of arranging but well worth it, and obviously the more players the cheaper it gets... or if some are better off than others then they can help cover the cost of the more strapped players, its all about team work :) Good luck and happy gaming.

Revdr said: So, I basically double (or more) my costs? I need to pay to use the API in the first place and then pay again for any game in which I play? While I can see how that's attractive to Roll20, it's not a great proposition as a user. I think the subscription options need to be clear that the API is only usable for games in which you're the GM. I think you might be misunderstanding a bit. If the GM is a Mentor, he or she can add any number of API scripts to the game, and then all players in that game get to use those scripts. You don't need to be a Mentor to use the API; you need to be a Mentor to add API to your game. Yes, if you want to develop scripts and play in multiple simultaneous games and use your scripts in those games, that's a problematic model. However, it's nice if you're running the games, or if you've got a circle of friends who's always playing together (the games can be created on the Mentor account, and then the actual GM of the game can be promoted), or if you join games of people that are already Mentors.

I completely understand the Roll20 model which assumes that all GMs are comfortable with allowing people they've never met to install unknown scripts into their own accounts and then run them during games. I just happen to think that it's a bad idea. I'm responsible for the security of the online and mobile banking at a UK financial institution, so maybe I'm less trusting than average (although I think I have good reason to be). If you asked me, as GM, if you could run your own scripts, I'd be likely to say "no", unless I knew you personally, and possibly not even then. I guess I could, if I code inspected the script and it was trivial, but I'd still need to trust the quality of the code. If a script crashes the game, players will blame the GM. Most GMs who aren't techies will be nervous about that possibility. (Especially since the API screen specifically warns them to only run scripts on a copy of their game).

Revdr said: I completely understand the Roll20 model which assumes that all GMs are comfortable with allowing people they've never met to install unknown scripts into their own accounts and then run them during games. I just happen to think that it's a bad idea. I'm responsible for the security of the online and mobile banking at a UK financial institution, so maybe I'm less trusting than average (although I think I have good reason to be). But that's not how it works. Players don't install scripts and then run them in games. GMs add the script to the game, and then they are available in the game.

Sorry, the language was ambiguous. Let me try again: "assumes that all GMs are comfortable with allowing people they've never met to install unknown scripts into the GM's own account and then run them during games" How will the script get into the game? a) The moderately techie GM takes the script from the player and installs it herself (most likely by cutting & pasting it in) b) The non-techie GM has no idea how to use the script editor, so he'll have to let the techie player do it. Either way the script is supplied by a user that the GM barely knows. Can we spell "trojan"?

You are correct that a lot of GM's wont just run API scripts from people they don't know. I wouldn't do it without checking the script personally to try and see what all the functions are. That said, the API affects the game by interacting with a limited number of properties. It is run in a sandbox on the API server, and has no access to information other than what is contained in the campaign. I don't know for sure that it is impossible to break out of the API sandbox, but IF someone did it, they would be running their malicious code on the API server, not your local machine. From there it would be a separate matter to access a users computer or account. Of course that still doesn't help with the matter of having to pay for access to the api to develop your scripts, then having to have another gm at mentor level agree to install and run them. If I didn't GM, I wouldn't be a mentor because my entertainment budget is too small for it to be worth it. Its a decision everyone has to make for themselves whether its worth it or not. There have been a few suggestions about increasing the value of a subscription for non GM's in the past, but none of them really seem to have gotten any support to speak of.

Roger A. said: I don't know for sure that it is impossible to break out of the API sandbox, but IF someone did it, they would be running their malicious code on the API server, not your local machine. The worst I've been able to do is temporarily modify read-only properties, and those changes didn't even persist to the next session since the changes weren't saved to the DB.

I've often wondered about people "trying" to mess with the server on roll20. I guess it would be traceable to a GM if someone was able to crash the API server.

Alright, this thread is getting off-topic, not to mention going to an unsavory place. The topic is Roll20's Mentor down API access model.