- What does pteroca-com/pterodactyl-addon do?
- It is a Laravel addon installed inside the Pterodactyl panel tree that connects Pteroca billing and customer accounts with Pterodactyl. It provides server provisioning, suspension, account linking, and Pterodactyl Application API communication. It is not a standalone service; it extends the panel's routes, middleware, and views.
- How do I install pteroca-com/pterodactyl-addon for Laravel and Pterodactyl?
- Run composer require pteroca-com/pterodactyl-addon:^0.1.4 inside the Pterodactyl panel directory, then run php artisan optimize:clear. No PteroCA configuration changes are required, and the existing Application API key scope should satisfy the addon. Pin the version and commit composer.lock if you want deterministic deployments.
- Which Pterodactyl and Laravel versions are supported by this addon?
- The release notes say it has been tested only on Pterodactyl 1.11.11 and 1.15.1. It runs on the panel's own Laravel runtime, so compatibility follows that Pterodactyl version. Validate against your exact pinned panel version before scheduling a rollout because the tested matrix is narrow.
- Is pteroca-com/pterodactyl-addon safe to use in production?
- Use version 0.1.4 or later. Versions 0.1.3 and earlier are affected by a critical CVSS 9.9 privilege-escalation and account-takeover chain involving unprotected /api/application/* routes, weak SSO token validation, and open post-login redirects. Treat the addon as security-critical infrastructure because it sits directly on authentication and user-provisioning paths.
- What changed in 0.1.4 and will it break my automation?
- Version 0.1.4 tightens authorization so API key endpoints require a root_admin identity and write permission, enforces SSO token expiry, and restricts post-login redirects to same-site paths. Automation, CI jobs, or service accounts calling those endpoints without root_admin will break. Previously issued non-expiring SSO tokens become invalid and must be re-minted, so stage the upgrade before production.
- How does account linking work between Pteroca customers and Pterodactyl users?
- The addon links Pteroca customers to Pterodactyl users and uses the Pterodactyl Application API for user and server operations. It extends the panel's authentication paths, including SSO, so token validation and redirect behavior are important parts of the integration. Ensure your Application API key has the user and server permissions your workflows require.
- How do I configure nests, eggs, and nodes for automated provisioning?
- The addon provides configurable mappings for Pterodactyl nests, eggs, and nodes so Pteroca orders can be provisioned onto the correct game-server templates and infrastructure. Configuration is Laravel-native through the panel's config and service provider setup. Map each Pteroca product to the appropriate nest, egg, and node before enabling automated provisioning.
- Can I test pteroca-com/pterodactyl-addon without affecting live game servers?
- Use a staging Pterodactyl panel at your pinned version and a scoped Application API key. Exercise provisioning, suspension, account linking, SSO login, and redirect behavior before production. Because 0.1.4 changes authorization and token expiry, include tests for non-admin automation and previously issued SSO tokens.
- How does this addon compare with building a custom Pterodactyl integration?
- A custom integration gives full control but requires reimplementing API communication, account linking, provisioning, suspension, and SSO. This addon packages those flows as a Laravel package that extends the panel's routes, middleware, and views. The tradeoff is coupling to a pre-1.0 dependency with a narrow tested version matrix.
- What is the maintenance and security response policy for the 0.1.x line?
- The project is pre-1.0, so there is no semver stability guarantee and minor bumps can carry behavior changes. The 0.1.4 release shows a coordinated advisory and credited reporter, but a repeatable security SLA and supported-version policy are not documented in the provided material. Ask the maintainer about the disclosure process, patch turnaround, supported versions, and the expected path to 1.0.