Access Token Flow

This document explains the secure flow of the user access_token through the Chainskins extension and backend.

Flow Overview

1. User Authentication via Steam

   • The user logs in via the browser extension.
   • The extension retrieves the access_token directly from the user's Steam account.

2. Daily Key Generation & Preconnect

   • Each day, the Cloud Function generates a new public/private key pair.
   • The extension performs a preconnect request to obtain the current day's public key.

3. Encrypting Token & Sending to Cloud Function

   • The extension encrypts the access_token using the public key.
   • The encrypted token is sent to the Cloud Function.
   • Important: The token is never stored in the extension or server.

4. Accessing Trade Offer Status via API

   • The Cloud Function decrypts the token using the private key.
   • It calls the Steam API to fetch steam api endpoints.
   • The token is discarded immediately after use.

5. Forwarding Data to Chainskins.net

   • The Cloud Function sends only the trade offer response data to Chainskins.net.
   • No sensitive tokens are ever stored or forwarded.