AbraTabia Game Server: Self-Hosted Multiplayer Server for Turn-Based Games

What AbraTabia Game Server Is

Every turn-based multiplayer game needs the same three things: a way for players to find each other, a way for friends to play together on purpose, and a way for every player to see every move in the same order. Building that usually means standing up a websocket server, writing lobby logic, and keeping a persistent process alive somewhere. AbraTabia Game Server solves all three with five plain HTTPS endpoints, so your game joins a queue, polls until it is matched, and then sends and receives moves.

The design choice that makes it different is that the server knows nothing about your game. A move is an action with a type and three data fields, and those fields are opaque strings your clients define. Chess notation, card plays, dice rolls, word submissions, chat lines, surrender flags, the server stores them, orders them, and hands them to every player in the match. That means the same server runs a chess game, a card game, a word game, and a party quiz at the same time without a line of server code changing.

The whole system is deliberately small. One PHP application, one SQLite database file, no framework, and no dependency install. It runs on shared hosting, a VPS, a Docker container, or your laptop during development. Queue entries and finished matches expire and clean themselves up automatically, so there is nothing to babysit. An admin area shows the live queue, the active matches, and each match's full action log, with the ability to end a stuck match from the browser.

The project is written and maintained by Paul Crinigan of AI Apps API, and the full source lives at github.com/AIAppsAPI/AbraTabia-Game-Server.

How Public Matchmaking Works

A player joins the queue with three things: a player ID your game generates, one or more game modes, and a party size. Game modes are just strings your game invents, 1V1, RANKED, BLITZ, whatever fits, and a player can queue for several at once, like "I will take either a ranked or a casual match, whichever fills first." The server groups players who share a mode and want the same match size, from two player duels up to ten player free-for-alls.

The moment enough compatible players are waiting, the match forms. Everyone learns their player number, the agreed mode, and the other players' display names and loadout info, three optional free-form fields each player carries into the match for things like decks, characters, or skins. Players who are still waiting simply poll a status endpoint every couple of seconds until their match appears, and a waiting spot that never fills expires on its own so stale entries never clog the queue.

Private Matches With Join Codes

Playing with friends skips the queue entirely. One player opens a private lobby and gets back a short join code, six characters, easy to read out loud over voice chat or paste into a group text. Friends join with the code, and when the lobby reaches the size its creator chose, the match starts with everyone in it. The lobby creator's settings win, so the host decides the mode and the player count and friends just need the code.

Join codes are generated to avoid look-alike characters, and a game can also supply its own code when it wants to control the format. Either way the code is the whole invitation, there are no accounts on the server and nothing for players to sign up for. The private matches and modes guide covers the full design space, from multi-mode queueing to carrying loadouts into a match.

Turn Sync With an Ordered Action Log

Once a match is running, gameplay is two calls. A player sends an action, the server assigns it a permanently increasing action ID, and every client polls for actions newer than the last ID it has seen. Every player receives every action in exactly the same order, which is the property that makes deterministic turn-based games work: each client replays the same log and arrives at the same game state.

Polling every second or two is plenty for turn-based play, and it is the reason the server runs anywhere. There is no websocket to keep open, no long-lived process, no special hosting requirement, each poll is an ordinary HTTPS request that returns instantly. The log also gives you reconnection support without extra work: a player whose phone dropped its connection asks where it is, gets the match state back, and re-pulls the full action log from zero to rebuild the board.

Actions cover more than moves. Because the types are yours, a quit is an action, a draw offer is an action, an emote is an action, and your clients decide how to react to each. The server keeps the match alive as long as actions keep flowing and quietly expires abandoned matches after an hour of silence.

Quick Start and the Demo Game

Requires PHP 8.1 or newer with the pdo_sqlite extension, standard almost everywhere. Locally:

cp config.sample.php config.php
# edit config.php: set apiKey and adminPassword
php -S localhost:8080 -t public

Docker users run docker compose up --build instead, and shared hosting users upload the project and point a docroot or subdomain at the public/ folder. The SQLite database creates itself.

Then open demo.php in two browser tabs. The demo is a complete, playable two-player tic tac toe built on nothing but the five API calls, and the two tabs will match against each other through your own server in about ten seconds. It doubles as a reference client: one page of plain JavaScript showing the whole flow, join, poll status, render state from the action log, send moves, and the build a game walkthrough explains it line by line. The getting started guide covers each install path plus every config setting, and every endpoint and field is documented in the API reference.

Works With Any Engine or Device

The primary API is plain HTTPS with JSON, so the client side is whatever your project already is. A browser game calls it with fetch, Unity uses UnityWebRequest, Godot uses HTTPRequest, and native mobile, Discord bots, and desktop games all speak the same five endpoints. If your platform can make a POST request, it can have matchmaking and multiplayer.

There is also a second response format built for clients that would rather split strings than parse JSON: add one field to any call and responses come back as simple comma and newline separated lines. This is the format our own Unity chess integration grew up on, and the Unity and legacy protocol guide documents every line format plus a C# example that parses a match with two calls to Split(). Use JSON for anything new, and use the split-string mode when it makes your client code simpler.

That pairs naturally with the topics covered across this site: multiplayer web games for networking approaches in the browser, game genres for picking a turn-based format worth building, and AI game development for the broader workflow.

Add an AI Game Master

The game server handles the players, and our open source AbraTabia AI Storyteller handles the narration. Its gamehost bots are turn-based AI game masters for 1 to 10 players, they collect secret setup data, track turns, and apply whatever rules you send as text. Run both servers and you get the full picture: the game server matches the players and syncs their moves, and the storyteller provides an AI game master that narrates the session, adjudicates free-form actions, and reacts to each player. A social deduction game, an AI-refereed word battle, or a narrated dungeon crawl uses both together, each doing the half it is built for. The gamehost guide covers the AI side of that pairing.

Documentation and Guides

Setup and Reference

Building With the Server

The GitHub README is the fastest technical overview, and issues and contributions are welcome there.

Security Notes

Set apiKey and adminPassword to long random strings before exposing the server, serve over HTTPS in production, and lock corsOrigin to your game's origin once you are live. For competitive games, remember the server relays moves by design, so have your clients validate each other's moves from the shared action log and end the game on anything illegal, every client has the full log, which makes cheating visible to everyone. For casual play between friends, the defaults are all you need.