API
The site talks to a separate backend. These are the methods a hunter, creator, or integrator needs. Admin wallet and payout routes exist, but they are not a public integration surface.
Production
https://zechub.zone
Local
http://localhost:9000
How to call it
Send JSON. Authenticated methods take Authorization: Bearer <jwt>. The GitHub login flow sets that token. Do not put it in a query string.
curl -sS "https://zechub.zone/api/leaderboard?limit=25"
curl -sS "https://zechub.zone/api/users/<id-or-nickname>/public"
curl -sS "https://zechub.zone/api/bounties"
curl -sS -X POST "https://zechub.zone/api/bounties/apply" \
-H "Authorization: Bearer $TOKEN" \
-H "Content-Type: application/json" \
-d '{"bountyId":"<id>","message":"I can take this."}'Chain values are MAIN, TEST, and ALL. Non-MAIN on the public leaderboard returns 403 unless the caller is an admin.
Auth
Mounted at /auth, not /api.
| Method | Path | Access | Use |
|---|---|---|---|
| GET | /auth/github | Public | Start GitHub login |
| GET | /auth/github/callback | Public | OAuth callback |
| GET | /auth/discord | Public | Start Discord connect |
| DELETE | /auth/discord | Signed in | Disconnect Discord |
| GET | /auth/me | Session | Current user |
| PATCH | /auth/update-nickname | Signed in | Set nickname |
| PATCH | /auth/select-role | Signed in | Hunter or team |
| PATCH | /auth/update-ua-address | Signed in | Register payout UA |
| POST | /auth/verify-uaddress | Signed in | Check a UA before saving |
Never send a seed phrase or spending key. Payouts use the registered receive address only. See Privacy & payments.
Public reads
/api/leaderboardOptional auth. timeRange=all|30d|90d, chain, limit (max 100)./api/users/:idOrNickname/publicPrivacy-filtered profile. Owner or admin may pass ?full=1./api/bountiesOptional auth. Private team bounties are filtered for non-admins./api/bounties/categoriesNo auth./api/teams/:teamId/overviewOptional auth.Profile visibility
GET /api/users/:idOrNickname/public is the privacy boundary. Missing keys are off, except avatar and display name.
| Flag | Default | When hidden |
|---|---|---|
| showDisplayName | On | Anonymous contributor; name and nickname omitted |
| showAvatar | On | avatar omitted |
| showCompleted | Off | completed and submitted counts omitted |
| showEarnings | Off | totalEarned omitted |
| showCreated | Off | created count omitted |
| showCompletionRate | Off | rate omitted |
| showRecentBounties | Off | recent bounty lists omitted |
| showBio | Off | bio omitted |
| showBadges | Off | badges omitted |
| showRole | Off | role omitted |
| showGithub | Off | GitHub id omitted |
| showAddressType | Off | address type omitted |
| showMemberSince | Off | join date omitted |
Signed-in methods
/api/bounties/applyApply to a bounty/api/bounties/my-applicationsYour applications/api/bounties/:id/submitSubmit work/api/bounties/my-submissionsYour submissions/api/bountiesCreate a bounty/api/users/me/profile-settingsYour visibility flags/api/users/me/profileBio and profileVisibility/api/kpis/top-contributorsKPI board. rankBy=completed|earned/api/notifications/push/subscribeRegister a push endpointTeam membership, team wallet, and verification routes are under /api/teams and require a token. Approval, payment, rescan, and full user export routes are admin-only.
Security to consider
One visibility contract for every page
A blurred name or a Hidden Hunter label is not the control. Every response that names a user applies the same profileVisibility flags as GET /api/users/:idOrNickname/public. The owner and an admin still see their own full fields.
- Public profile, the leaderboard, the KPI board, bounty cards, team overviews, and websocket payloads all follow that contract. A field omitted on the public profile is omitted everywhere else for that user.
GET /api/leaderboardis public. Name and nickname requireshowDisplayName. Avatar requiresshowAvatar. Completed count requiresshowCompleted.earnedandpointsrequireshowEarnings, because points are derived from earnings. Rank stays. Redaction happens before the 60-second cache write. Non-MAIN queries stay admin-only.GET /api/kpis/top-contributorsis authenticated and uses the same flags. Name and nickname requireshowDisplayName. Avatar requiresshowAvatar. Completed count requiresshowCompleted.totalEarnedis null unlessshowEarningsis on. Payout addresses are never returned to non-admins. Rank stays.- Bounty and team pages show an assignee or member only to the level that user allowed. A hidden display name is an anonymous label. A hidden earnings flag strips amounts from that user's rows, not only from the profile page.
- Websocket events use the same filter and go only to the intended audience. A socket payload is not a second, wider copy of the user.
- Do not paste a bearer token into a third-party site. Never send a seed phrase. Wallet import and pay routes can move funds and stay on an authenticated session you control.
Reporting bugs and concerns
File it against the route, not the page that renders it
A privacy miss is a response that includes a field the public profile omits for that user. Include the method, path, and which flag was ignored. Do not paste tokens, seeds, or another person's hidden values.
- Bugs and privacy concerns: GitHub issues. A short request and response shape is enough. Redact names, earnings, and addresses before you attach it.
- Questions that are not a defect: ZecHub Discord, or @ZecHub.
- Payment and address problems belong on Privacy & payments. Do not send a seed phrase to any of these channels.