Secure Start.gg companion

Banana Peel

Follow players, manage match-day queues, and keep shared Start.gg access on the server where it belongs.

Check StatusDeployment Path

Shared Start.gg key stays on Render.

Mobile clients talk to this origin at /api.

Banana Peel sessions gate shared public cache reads.

Production boundary

Built around a private backend.

Same-origin API

The apps use https://bananapeel.farflash.com/api, so the Render service origin is never shipped as a public client setting.

Session required

Public cache misses use the server key only after a valid Banana Peel account session is present.

Admin locked

Maintenance routes stay behind X-Cache-Admin-Token and are not exposed through any public UI.