Battle.net

The Corma and Battle.net integration helps IT see where Blizzard's gaming platform touches your company and keep a record of who owns the API credentials behind it. Blizzard's license agreement defines the Battle.net Platform as the Battle.net desktop app, the gaming service, each of its games and related mobile apps, and Microsoft completed its acquisition of Activision Blizzard on October 13, 2023. For most companies Battle.net is a consumer service that appears as shadow IT. For teams building on Blizzard's developer APIs, it is also where API credentials live.

Key takeaways

• Under Blizzard's EULA, only an adult natural person may establish a Battle.net Account, and corporations or other business entities may not.
• Blizzard does not recognize Battle.net Account transfers, and its EULA forbids sharing an account or its login information.
• A Blizzard API Key is one or more OAuth clients created in the Developer Portal, with a limit of 50 clients per developer at a time.
• Battle.net API usage requires a Battle.net Authenticator on the developer's account, and Blizzard access tokens last 24 hours.

Why do Battle.net API clients depend on one person?

Blizzard's Developer API Terms of Use require a Battle.net account and Developer Site registration to obtain an API Key, and forbid sharing, selling or transferring that key. Blizzard documents no business account and no way to move clients between developer accounts, so the clients an integration relies on stay attached to the employee who created them.

That account carries other dependencies. Blizzard's getting started guide requires a Battle.net Authenticator for any API usage, and an Authenticator needs a phone number that can be attached to only one Battle.net Account. When a new client secret is generated, the old secret stays valid until the expiration the developer sets. Blizzard does not document what happens to API clients when the owning account is closed, and it may revoke API access at any time without notice.

How Corma governs Battle.net

• Usage made visible: Corma discovers apps through browser signals and financial data, which is how consumer services such as Battle.net can surface in your shadow IT inventory.
• API clients with an owner: Developer Portal clients and their secrets are non-human identities, so each one needs a named owner on your side and a planned successor.
• Leavers with a credential check: a leaver workflow in the IT Workflow Builder asks the team to replace any API clients created under that person's account with clients owned by another developer.
• Developer access in review: the employees whose accounts hold company API clients are mapped as owners and confirmed in automated access reviews.

Frequently asked questions

Does Battle.net support SSO and SCIM?

Blizzard documents neither SAML single sign-on nor SCIM provisioning for Battle.net. Its EULA reserves accounts for natural persons and licenses the platform for personal, non-commercial entertainment purposes. Read how to offboard apps without SCIM, SAML or SSO.

How does Corma connect to Battle.net?

Blizzard documents no admin or user-management API: the only account endpoint in its OAuth API returns a user's account ID and BattleTag. Corma works from its discovery signals and from your records of who owns each API client, rather than provisioning Battle.net accounts. Read what an API key is.

Where is Corma data hosted?

Corma runs on AWS, with web servers and databases in data centers inside the European Union. Data is encrypted in transit and at rest, and Corma is ISO/IEC 27001:2022 certified.

Want a named owner for every company Battle.net API client? Book a Corma demo.