External APIs

BattleMetrics

src/services/battlemetrics.ts. Used for:

• Looking up player aliases (!alias).
• Looking up player session history.
• Tracking online state of tracked players.
• Surfacing server metadata (rank, wipe time, official tags).

Token: BATTLEMETRICS_TOKEN env (paid).

Caching:

• Aliases — cached forever; explicit "refresh" button hits BM again.
• Online state — cached 60s.
• Player session history — cached 5 minutes.

Quota:

• Daily budget tracked in BattleMetricsQuota table.
• When budget is exhausted, the API returns cached data with a stale: true flag, never falsely fresh.

Steam Web API

src/services/steam-web.ts. Used for:

• Resolving Steam vanity URLs to Steam64.
• Pulling profile data (avatar, real name) when a tracked player has a linked Steam ID.
• Confirming a Steam ID is well-formed during admin operations.

Token: STEAM_WEB_API_KEY env (free with a Steam developer account).

Facepunch companion-rust.facepunch.com

The Credentials Helper interacts with this; the API itself does not. The helper:

• Loads /login?token=<expoToken> for Steam OpenID.
• POSTs to /api/push/register to bind the Expo push token.

If Facepunch ever changes their endpoints, see Connect with Rust+ for the brittle bits.

A2S / Source-engine query

src/services/a2s.ts. Used for:

• Pulling server populations on demand from servers that don't expose them through Rust+.
• Discovery-only — never blocking the main flow.

No auth; UDP-based.

All external services are non-critical

Every external API is wrapped with timeouts (5s default), retries (1 retry with backoff), and graceful-degradation behaviour. A BattleMetrics outage degrades player intel features but doesn't break the dashboard. A Steam API outage doesn't break Steam-OpenID login (Steam itself handles that), only the optional profile-enrichment.