API overview

rustplus-api is the heart of the platform. Node 20+, TypeScript ESM, Fastify 4, Prisma, Postgres. Every route is wired up in src/server.ts.

Base URLs

• Production: https://api.rustpulse.app
• Local dev: http://localhost:3000

Authentication

• Session — encrypted rp_sess cookie, set by /auth/steam/callback. httpOnly, secure in prod, sameSite=lax. Required for all dashboard endpoints.
• Device bearer token — 48 bytes, returned by /pairing/device/activate. Sent as Authorization: Bearer <token> from the Credentials Helper and overlay.
• Relay JWT — minted by /relay/token. Short-lived (~5 min). The only thing the relay WebSocket accepts.
• Internal HMAC — X-Internal-Signature between API ↔ FCM listener worker.

Route categories

Database

Postgres + Prisma. Schema at prisma/schema.prisma. Migrations in prisma/migrations. Highlights:

• User — Steam-anchored user.
• Subscription — Stripe sub status.
• BetaTester — admin-granted free tier.
• PairedServer — one row per Rust+ pairing.
• FcmCredential — encrypted FCM blob.
• DiscordIntegration — per-user Discord guild routing.
• DashboardGuestAccess — guest invites.
• MapNote, SmartDevice, TrackedShopItem, PlayerIntelNote, PlayerSteamLink, etc.

See Data model for the full table.

Workers

Two long-running processes outside the API HTTP server:

• npm run worker:fcm — FCM listener. One client per active user.
• npm run worker:relay — relay. One Rust+ socket per paired server.

Both communicate back to the API over signed internal HTTP.

Per-section docs

• Authentication
• Admin endpoints
• Billing & Stripe
• Credentials & pairing
• Relay (WebSocket)
• Overlay endpoints
• Intel endpoints
• External APIs (BattleMetrics, Steam)
• Health & status