Real achievements & XP written straight into XP Network
XP Network is the system of record for the whole competitive hierarchy — organizations, leagues, events, tournaments, achievements, roles, and XP balances. Rather than rebuild any of that, High Noon Arena owns the live-scoring and presentation layer and writes earned achievements directly into XP Network, where the reward XP pays out automatically. Players link once at join; from then on, everything they earn at the table lands on their real account.
XP Network has a real API program — but it's priced for the big boys and clearly built for enterprise partners, not a bootstrapping tabletop launch. The org portal, however, hands the account owner a token with full write scope. So the call was made: don't pay the enterprise toll — outlaw-gun through the barrier with our own clean code against the org-owner credential.
Not only is that non-offensive to XP Network (whom we know personally), if we pull it off it turns their heads — it's the working proof that earns a real partner conversation. This module is that proof: a delivery driver that reaches into a live production XP system and grants real rewards, built on nothing but the org token and reversed API calls.
Three moving parts, each verified against the live API.
A single POST /achievements/organization/100/unlock/batch unlocks an achievement for one or more users and, with enable_reward:true, pays out the tier's XP. Verified live with real grants (200 — “Unlocked achievement for 1 users”).
At join a player supplies their XP Network handle. resolveAndLink() hits the global user search, exact-matches the username, and stores their numeric user_idon the account. Confirmed live (silverhelm → 4368).
Every grant is idempotent per (player, achievement, event) and logged with a receipt. Unlinked players are flagged rather than silently dropped, so no earned XP ever vanishes.
Tournaments run on flaky venue wifi. A transient network blip or rate-challenge triggers a spaced 1/2/4/8s retry — generous enough that retries never feed the limiter, so a single dropped packet never loses a real grant.
XP Network's edge intermittently challenges the bare server fingerprint. The driver presents a normal browser identity (UA / origin / referer) so server-side grants behave exactly like the portal's own calls.
The org-owner credential is a standalone 30-day bearer — confirmed independent of the browser session (survives logout and re-login). A daily job checks expiry and pings the channel only inside the ~3-day window.
The token lives in a gitignored secret locally and a Vercel env var in production — never committed, never synced to the client. Reads are public; only writes verify, so the credential is the one guarded thing.
What's shipped, and what's still on the queue.
| Aspect | XP Network Enterprise Tier | Our Bootstrapped Driver |
|---|---|---|
| Cost | Priced for enterprise partners | $0 — rides the org-owner token |
| Access | Formal API program, gated onboarding | Reversed REST calls, live today |
| Write path | Sanctioned endpoints | POST /unlock/batch, verified with real grants |
| Linking | Whatever the tier provides | Global user search → exact-match → stored id |
| Time to live | Partner negotiation cycle | Shipped to production in one night |
Origin: XP Network's enterprise API tier priced us out; the org-owner token gave us a way through. Built 2026-08-11.
Prereqs: None outstanding — org token in hand, write path and linking both reversed and verified against the live API.
Status: X1–X3 shipped and live in production. Real grants confirmed end-to-end; token durability confirmed across logout/login. X4 (automatic in-game triggers + a durable service token) is the remaining driver-level work. The operator UI that rides this driver is its own module — the Bounty Board.
Internal strategy page. Keep this honest as the build changes.