Launch Params and Share Links

Canonical share URLs

Use the Buncha Games wrapper URL as the player-facing share link. The wrapper keeps the normal Buncha Games play chrome, loads the game in the isolated runtime iframe, and forwards only approved launch params.

Do not ask players to use direct runtime-host URLs such as play.bunchagames.com/games/<slug>/ unless Buncha Games specifically tells you to for a temporary test.

https://bunchagames.com/play/cozycubes?tour=ca3b0945-d4c8-4a88-a5fd-6697a86a3e08
https://bunchagames.com/play/my-game?room=alpha-room-42
https://bunchagames.com/play/my-game?seed=daily-2026-06-25

Forwarded params

Buncha Games forwards only approved launch params from the wrapper URL into the game iframe. This avoids leaking unrelated account, debug, tracking, or platform params into games.

Current approved params are tour, room, invite, seed, and mode. Games must still validate each value before using it.

tour: read-only shared state such as an island, level, replay, or gallery snapshot.
room: multiplayer or private-room invite state.
invite: invite or join token state when the game owns validation.
seed: deterministic daily, challenge, or procedural seed.
mode: safe game-owned launch mode, such as arcade, daily, editor, or tutorial.

Game-side validation

Forwarding a param does not make it trusted. Treat launch params like normal user input.

Validate format, length, allowed characters, ownership or visibility, and whether the requested state is safe to show to the current player.

const params = new URLSearchParams(window.location.search);
const tourId = params.get("tour");

if (tourId && /^[a-zA-Z0-9_-]{8,120}$/.test(tourId)) {
  openReadOnlyTour(tourId);
}

Hash params

Query params are the canonical choice for first-load wrapper launch state. URL fragments after # are not sent to the server when the wrapper page is requested, so they are less reliable for platform-mediated launch behavior.

A game may still use hash state internally after it has loaded, but shared Buncha Games links should prefer /play/<slug>?tour=<id> style URLs.

Security boundaries

Only allowlisted keys are forwarded.
Forwarded values remain strings; the game decides whether they match its expected format.
Do not put secrets, auth tokens, emails, private account ids, or payment/provider state in launch params.
Launch params do not grant entitlements, purchases, room ownership, or private data access by themselves.

All docs Request invite