CS2 Bridge

CS2 Stats Bridge

accshift can show CS2 stats directly on Steam account cards: current level, weekly XP progress and whether the weekly care package has already been earned. Hover an account card to see the fields with the rest of its details.

accshift does not derive these values from Steam. It fetches them from an HTTP endpoint you configure, so any service that implements the contract below can supply the data.

Setup

1. Open Settings > Steam > CS2 stats bridge.
2. Paste the complete endpoint URL supplied by its operator, or implement the contract below.
3. Enable the toggle. The status dot turns green when the connection works and shows how many accounts the server returned.

The optional API token is sent as an Authorization: Bearer header and is encrypted in the OS vault. The endpoint URL is stored in the regular app config. If the URL contains a secret path or query value, that value is not vault-protected; prefer the token field when possible.

If the test fails, the status dot turns red and exposes the returned error. Background refresh failures are also written to the local app log.

Bridge contract (for server authors)

For the account list, accshift sends GET to the configured URL, with the optional Bearer header. The expected 200 response is:

{
  "generatedAt": "2026-07-11T12:00:00.000Z",
  "accounts": [
    {
      "steamId": "76561198000000000",
      "level": 16,
      "xp": 3579,
      "xpMax": 5000,
      "caseEarned": false,
      "weekStartTs": 1779843600000,
      "lastUpdated": "2026-07-11T09:00:00.000Z"
    }
  ]
}

Field notes:

• steamId: SteamID64 as a string. This is the join key with accshift's Steam accounts.
• level / xp: current CS2 level and XP within the level. Use null when unknown; accshift then shows nothing for that account.
• xpMax: XP needed per level. Defaults to 5000 if omitted.
• caseEarned: whether the weekly care package was already earned this week.
• weekStartTs / lastUpdated: optional metadata (epoch ms / ISO 8601).

Accounts unknown to accshift are ignored. Responses larger than 1 MB are rejected.

Refreshing one account

After switching away from a Steam account, accshift can request fresh data for that SteamID64:

POST <configured-url>/check
Authorization: Bearer <token>
Content-Type: application/json

{"steamId":"76561198000000000"}

The expected 200 response wraps one row:

{
  "account": {
    "steamId": "76561198000000000",
    "level": 16,
    "xp": 3579,
    "xpMax": 5000,
    "caseEarned": false
  }
}

If /check returns 404, 405 or 501, accshift falls back to a GET on the configured URL with ids=<steamId> added to the query string and reads the matching row from the normal accounts response. The single-account request has a 30-second timeout. Every response is capped at 1 MB, including chunked responses.

Security recommendations for public servers

• Serve the bridge over HTTPS only.
• Prefer the Bearer token field over secrets embedded in the URL. Provide a way to rotate and immediately invalidate tokens.
• Keep the response minimal: no aliases, notes or unrelated account data, and expose no management actions beyond the optional single-account refresh.
• Rate-limit the endpoint.