Game‐Server Bridge

Game-Server Bridge

The bridge lets an in-game plugin (AMX Mod X, SourceMod, etc.) securely pull commands queued by the website — vote rewards, store purchases, bans — and run them on the server. It's the link that turns website actions into in-game effects.

How it works

1. In the admin panel you generate a bearer token for a server.
2. The in-game plugin polls the bridge API with that token and receives a batch of commands to execute.
3. After running them, the plugin confirms (acks) which commands succeeded.
4. Unconfirmed commands are retried; expired ones are never delivered.

Tokens are stored hashed — the plain value is shown only once. Delivery is at-least-once, so plugins should treat command IDs as idempotent where possible.

Generating a token (admin)

1. Go to Admin → Servers.
2. Click the plug icon on the server row.
3. Copy the token shown — it is displayed only once. If you lose it, generate a new one (which invalidates the old).
4. Right-click the plug icon to revoke the token.

A green dot on the plug means the plugin has checked in within the last 2 minutes; amber means it hasn't been seen recently.

API for plugin developers

All requests use Authorization: Bearer <token> and are rate-limited.

Poll for commands

POST /api/bridge/poll

Response:

{
  "server": { "id": 1, "name": "My Server" },
  "commands": [
    { "id": 42, "command": "hc_give_vip STEAM_0:1:1 30d" }
  ]
}

Up to 25 commands per poll.

Acknowledge executed commands

POST /api/bridge/ack
Content-Type: application/json

{ "ids": [42] }

Response:

{ "acked": 1 }

Queueing commands (extension developers)

Extensions push commands through the BridgeService:

use App\Services\Bridge\BridgeService;

app(BridgeService::class)->queue(
    $server,                       // App\Models\Server
    "hc_give_vip {$steamId} 30d",  // console command, max 500 chars, no newlines
    'hybridcore/store',            // your extension id (for auditing)
    ttlMinutes: 60,
);

Commands containing control characters or newlines are rejected to prevent console-command injection. See BUILDING_EXTENSIONS.md.