# Copy this to config.toml, fill in real values, then `chmod 600 config.toml`.

[server]
bind_addr = "127.0.0.1:8095"

[steam]
# Get a key at https://steamcommunity.com/dev/apikey
# By using it you agree to https://steamcommunity.com/dev/apiterms
api_key = "REPLACE_WITH_YOUR_STEAM_WEB_API_KEY"
# Buffer under Valve's default 100,000 calls/day cap.
daily_limit = 90000
# Sent as the User-Agent header on every call to the Steam Web API. Steam's
# dev page asks integrators to be identifiable; put whatever app name/contact
# info you're comfortable making public here (this is never returned to
# callers of this service, only sent to Steam). Leave generic if publishing
# this source tree so no personal info is baked into the binary.
user_agent = "steamapi-app/0.1"

[auth]
# Shared secret callers must send as the X-Api-Token header.
token = "REPLACE_WITH_A_LONG_RANDOM_TOKEN"

[quota]
# Persists the daily call tally across restarts. Relative to the working
# directory the process is started from.
state_file = "state.json"

[cors]
# Origins allowed to call this API cross-origin from browser JS (sets
# Access-Control-Allow-Origin, and handles the OPTIONS preflight). Exact
# match, no trailing slash, e.g. "https://example.com". Note that since
# these calls come straight from browser JS, the X-Api-Token above is
# necessarily visible to anyone who opens devtools on that site — it's a
# deterrent against casual scraping, not a hard secret, once listed here.
allowed_origins = ["https://REPLACE_WITH_YOUR_FRONTEND_ORIGIN"]