For the complete documentation index, see llms.txt. This page is also available as Markdown.

Set Community Link

Directly link an authenticated community account to an in-game user ID.

POST https://api.sonorancad.com/v2/general/links/set

Rate limit: 30 requests per minute Authenticated v2 endpoints are rate limited per API key rather than per IP address.

Directly assign a communityUserId to an account in the authenticated community. The account UUID and its community-specific secret UUID must match. If the in-game ID is already linked to another account, the link is reassigned atomically.

This endpoint is intended for trusted server-side integrations such as the SonoranCADFiveM resource. Do not expose the community API key or forward account credentials from an untrusted client directly to this endpoint.

CAD Frontend Iframe Event

When the Sonoran CAD frontend is running inside an iframe, it sends the following message to its parent after every successful community login, re-login, or reconnect:

window.parent.postMessage({
  type: 'scad:account-link',
  accountUuid: '11111111-1111-1111-1111-111111111111',
  secretUuid: '22222222-2222-2222-2222-222222222222',
}, '*');

The event is not emitted in a top-level browser window or when either UUID is unavailable. It does not contain communityUserId; the parent integration must derive that value from the current in-game player and send all three values from its trusted server process to this endpoint.

The parent page should verify both event.source and event.origin before accepting the credentials:

const cadFrame = document.getElementById('cadFrame');
const cadOrigin = new URL(cadFrame.src).origin;

window.addEventListener('message', (event) => {
  if (event.source !== cadFrame.contentWindow || event.origin !== cadOrigin) return;
  if (event.data?.type !== 'scad:account-link') return;

  const { accountUuid, secretUuid } = event.data;
  // Forward these values to the trusted game server. The server derives the
  // player's communityUserId and calls POST /v2/general/links/set.
});

Treat secretUuid as sensitive. Do not log it, persist it in browser storage, or expose the community API key to the iframe or game client.

Request Body

All three properties are required. communityUserId may contain up to 255 characters.

Example Request

Call this endpoint from the server side of a FiveM resource. Lua and JavaScript resources can use the CAD client exported by sonorancad:

FiveM exports do not return a .NET client. A server-side .NET resource should read the protected sonoran_communityID, sonoran_apiKey, and sonoran_serverId convars and construct a SonoranClient. FiveM does not run Python resources; use Sonoran.py only for external integrations.

Import this YAML into Postman with Import -> Raw text to create a single-endpoint request collection for this route.

Response

A 403 response intentionally does not reveal whether the account UUID or secret UUID was incorrect.

Last updated

Was this helpful?