Client API won’t have the permission to edit other players’ data, and only Server/Admin API can do. Usually we recommend using Cloud Script/Azure Function, where Server API can be called.
Since Client API can execute Cloud Script/Azure Function, please remember to add verification steps before certain APIs are called. The function needs to verify if the caller is valid, or this execution is valid, to avoid abusive use from malicious players.
2 People are following this question.