Getting Started
Linking a KSP Client
Players connect the game to their Discord account once. From then on, contracts and rewards flow automatically, and no password or secret ever leaves the game client.
The flow
- 1
Request a code in Discord
A member asks the bot for a link code. A one-time 6-digit code is generated and stored in Firestore with a 10-minute time-to-live.
- 2
Enter the code in-game
The KSP mod’s linking window accepts the code and posts it to the API. The server validates it and, if valid, issues a 30-day HMAC-signed session token.
- 3
The token is stored locally
The mod saves the token to
PluginData/session.token. Every later request carries it; the code itself is discarded.
Why it is safe
The session token is signed with HMAC-SHA256 by the server. The client can present it but cannot forge one, and the bot’s signing secret never leaves the server. A leaked token only grants access for its limited lifetime and can be invalidated server-side.
No secrets on the client
The KSP mod only ever holds a short link code (briefly) and a signed session token. It never receives API keys, the Discord token or the Firestore credentials.
Token lifecycle
6-digit code -> Firestore, 10-minute TTL
exchanged for
session token -> HMAC-SHA256 signed, 30-day lifetime
stored at
PluginData/session.token (KSP mod, local only)