Badge admin
All mutating actions require an X-API-Key header. Default dev key is dev-admin-key-change-me; set ADMIN_API_KEY on the API to override.
Admin API key
Stored only in localStorage on your browser.
Issuer
The issuerId is what you need for key rotation, CLI tooling, or embedding your signing profile in third-party systems.
Ops
Download SQLite backup
Runs VACUUM INTO on the live DB (online-safe, no writer lock) and streams the file to your browser. Store the file plus your SECRETS_AT_REST_KEY in escrow — both are required to re-verify badges after a restore.
Purge audit log
Deletes rows older than AUDIT_RETENTION_DAYS (default 365). Intended for a scheduled runner but callable manually here.
Audit log
Recent audit events
Create
Create user
Create team
Compose achievement
Everything a badge can carry: name, description, difficulty, categories, a mascot image, and how long it stays valid. The mascot appears on the share cards and — if you set one per-achievement — on the badge's social preview.
Issue badge
Edit
Edit user
Edit achievement
Edit team
Revoke & delete
Destructive — each prompts for confirmation.