CS2 Bridge

CS2 Stats Bridge

accshift can show CS2 stats directly on Steam account cards: current level, weekly XP progress and whether the weekly care package has already been earned. Hover an account card to see the fields with the rest of its details.

accshift does not derive these values from Steam. It fetches them from an HTTP endpoint you configure, so any service that implements the contract below can supply the data.

Setup

1. Open Settings > Steam > CS2 stats bridge.
2. Paste the complete endpoint URL supplied by its operator, or implement the contract below.
3. Enable the toggle. The status dot turns green when the connection works and shows how many accounts the server returned.

The optional API token is sent as an Authorization: Bearer header and is encrypted in the OS vault. The endpoint URL is stored in the regular app config. If the URL contains a secret path or query value, that value is not vault-protected; prefer the token field when possible.

If the test fails, the status dot turns red and exposes the returned error. Background refresh failures are also written to the local app log.

Bridge contract (for server authors)

accshift never asks for a whole database. It sends the SteamID64 of the Steam accounts present on this machine and expects only those rows back, so one endpoint can serve several people without any of them seeing the others.

POST <configured-url>/accounts
Authorization: Bearer <token>
Content-Type: application/json

{"steamIds":["76561198000000000"]}

The expected 200 response is:

{
  "generatedAt": "2026-07-11T12:00:00.000Z",
  "accounts": [
    {
      "steamId": "76561198000000000",
      "level": 16,
      "xp": 3579,
      "xpMax": 5000,
      "caseEarned": false,
      "weekStartTs": 1779843600000,
      "lastUpdated": "2026-07-11T09:00:00.000Z"
    }
  ]
}

At most 300 ids travel per request; accshift splits larger lists into several calls. An empty list is a valid connection test and should answer 200 with an empty accounts array. Ids the server does not know must be left out of the response, not reported as an error.

If /accounts answers 404, 405 or 501, accshift falls back to GET <configured-url>?ids=<comma-separated ids>, which must return the same payload. Rows for accounts that were not requested are discarded on arrival.

Field notes:

• steamId: SteamID64 as a string. This is the join key with accshift's Steam accounts.
• level / xp: current CS2 level and XP within the level. Use null when unknown; accshift then shows nothing for that account.
• xpMax: XP needed per level. Defaults to 5000 if omitted.
• caseEarned: whether the weekly care package was already earned this week.
• weekStartTs / lastUpdated: optional metadata (epoch ms / ISO 8601).

Accounts unknown to accshift are ignored. Responses larger than 1 MB are rejected.

Refreshing one account

After switching away from a Steam account, accshift can request fresh data for that SteamID64:

POST <configured-url>/check
Authorization: Bearer <token>
Content-Type: application/json

{"steamId":"76561198000000000"}

The expected 200 response wraps one row:

{
  "account": {
    "steamId": "76561198000000000",
    "level": 16,
    "xp": 3579,
    "xpMax": 5000,
    "caseEarned": false
  }
}

Only one account per request. If /check returns 404, 405 or 501, accshift falls back to the read command above for that single id. The single-account request has a 30-second timeout. Every response is capped at 1 MB, including chunked responses.

Security recommendations for public servers

• Serve the bridge over HTTPS only.
• Prefer the Bearer token field over secrets embedded in the URL. Provide a way to rotate and immediately invalidate tokens.
• Answer only for the ids the caller sent, and refuse a request that carries none. A read command that returns everything turns one leaked link into a full account list.
• Keep the response minimal: no aliases, notes or unrelated account data, and expose no management actions beyond the optional single-account refresh.
• Rate-limit the endpoint, and refuse to refresh an account the server does not already track.