Rank API

Calling the API

Use https://req.hebnix.com/player/platform/id. Platforms: steam, epic, psn, xbl and switch. Replace id with the player's platform identifier. For Epic player IDs such as Epic|ID|0, remove Epic| and |0 and send only the ID: https://req.hebnix.com/epic/ID.

Set User-Agent to your application's name. The examples below use your assigned app's name when available; otherwise replace YOUR_APPLICATION_NAME with it. Product names cannot contain spaces and are matched without regard to letter case.

curl --request GET \
  'https://req.hebnix.com/player/steam/76561198343835205' \
  --header 'User-Agent: YOUR_APPLICATION_NAME' \
  --header 'X-App-Token: YOUR_TOTP_MD5_TOKEN'

Generating the request token

When TOTP proof is enabled, X-App-Token contains an MD5 hash of an eight-digit TOTP code. The code uses HMAC-SHA1 and a 30-second time step. Keep all eight digits, including leading zeros, before hashing. Generate a fresh token for each request and keep your server clock accurate.

Use View key on your assigned application to retrieve its Base32 private key. Store it in your server's secret manager. Never put it in browser JavaScript, a public repository, or a shared example.

export APPLICATION_KEY='YOUR_BASE32_PRIVATE_KEY'

TOKEN="$(
  python3 - <<'PY'
import base64, hashlib, hmac, os, struct, time

key = base64.b32decode(os.environ["APPLICATION_KEY"])
counter = struct.pack(">Q", int(time.time() // 30))
digest = hmac.new(key, counter, hashlib.sha1).digest()
offset = digest[-1] & 0x0f
code = (struct.unpack(">I", digest[offset:offset+4])[0] & 0x7fffffff) % 100000000
print(hashlib.md5(f"{code:08d}".encode("ascii")).hexdigest())
PY
)"

curl --request GET \
  'https://req.hebnix.com/player/steam/76561198343835205' \
  --header 'User-Agent: YOUR_APPLICATION_NAME' \
  --header "X-App-Token: $TOKEN"

Token-based applications spend request credits and have no hourly or minute limit. If the balance reaches zero, requests receive HTTP 429 with Application token balance exhausted; an administrator must replenish the balance. Rate-limit applications use their configured hourly and minute limits.