Connect a player
Open /oauth/authorize in the system browser with S256 PKCE and a random state. Exchange the one-time callback code at /oauth/token.
THE WEBUMP PLATFORM · PREVIEWLittle encounters.
Little encounters.
New possibilities.
Bring the people players pass into the apps and worlds you build. A profile, a shared game stat, a new visitor—with permission at every step.
Free to explore. No account needed for the sandbox. The demo is a real game on this API, open source.
Real weBump cards. Fictional people.
01 Profiles with permission02 Small game saves03 Visitors from local history
A PLACE TO EXPERIMENT
● SYNTHETIC DATAMeet your first visitors.
Run real HTTP requests against an isolated sandbox. Every profile here is fictional.
// Your first request is one click away. // No sign-up. No real player data.
Use this sandbox from your own code
Start a session to get a temporary sandbox-only token. Only copy it into test code.
Run a request to generate your example.
FROM PLAYGROUND TO PROJECTA small API.
A small API.
Room to play.
Build an app or game on any platform using the HTTPS API, a public client ID, and either callback-based OAuth with PKCE or explicit device approval. Players approve connections in weBump; your app stores its own delegated tokens securely.
Give their game a memory
Read /v1/me/state. Save a named value with PUT /v1/me/state/{key} and the latest ETag in If-Match. Keep a local save too.
Welcome a visitor
Read /v1/me/visitors: the people your player bumped, including verifiable recent history synced by weBump, once unwrapped and their reveal delay passed. Only their approved profile and game fields come through.
Sandbox coverage and live API limits
The sandbox implements profile reads, permissions, named game state, a simulated handoff, withdrawn-consent errors, and game-data deletion. It skips OAuth and encounter timing. Live connections require an approved project, player consent in the compatible weBump iPhone app, a verified HTTPS callback, and PKCE. Apple identifiers are not required for your integration. A dedicated desktop pairing flow is not available yet. Live handoffs use begin/redeem instead of the sandbox-only simulate action.
Private game state: 16 keys / 16 KiB. Shared capsules: 2 KiB with reviewed integer, boolean, or enum fields. Selected shared game data: 16 KiB of reviewed nested JSON, separate player opt-in, and authorized visitor access. Never store secrets or personal contact details. The platform is a preview, and deleted weBump installations lose their game data.
Developer agreement · September 10, 2026
Use weBump only for the app and purpose approved in your application. Request the minimum permissions you need. Respect player consent, withdrawal, deletion, and visibility choices. Do not sell player data, use it for advertising or tracking, identify people across apps, reconstruct location or encounter histories, or attempt to access another developer’s data. Never collect installation secrets or put access tokens in URLs, analytics, logs, or emails.
Provide accurate contact details, an accessible privacy policy, and support. Secure delegated credentials in device-protected storage. Delete withdrawn data and provide a deletion path. Report security incidents promptly to help@webump.app. Submit only artwork you have the rights to use and that is suitable for all players; game icons are screened automatically for harmful content when you submit them, and a rejected icon is neither stored nor published. Ask for review before changing callbacks, permissions, or shared fields. Access may be suspended for abuse or policy violations. This preview has no uptime or data-retention guarantee; keep your own game’s authoritative saves.
Developer privacy
We store your verified email, application, agreement acceptance, and review history to operate developer access. Approved contact emails appear on player consent screens. Sign-in codes expire after ten minutes, sessions after twelve hours, and synthetic sandbox sessions after one hour. Expired records are removed during daily cleanup. Unapproved accounts are removed after 180 days; approved application and account records remain while access is maintained. Request account deletion through support. Email is delivered through Resend; application data is stored on weBump’s server. Submitted game icons are sent to OpenAI’s moderation API for an automated safety check, without your name or contact details; if an icon is rejected we keep the verdict and its scores for abuse review, but not the image. This site uses essential authentication cookies and no advertising trackers.