RuneRank developer docs

A player opens /vote/your-server, enters their in-game username, passes anti-bot verification and the cooldown check. RuneRank records the vote server-side, updates the ranking, then sends a signed callback to your server.

RuneRank sends a POST request with Content-Type: application/json to your configured callback URL:

{
  "vote_id": "c2f4a1e0-...",
  "server_id": "8d1b7f92-...",
  "username": "Zezima",
  "timestamp": 1757404800,
  "signature": "5f0c...ac9"
}

Every server gets a unique secret, visible only in your owner dashboard. Verify the HMAC before granting a reward, and always compare in constant time:

// signature = HMAC_SHA256(secret, vote_id + ":" + server_id + ":" + username + ":" + timestamp)
String data = voteId + ":" + serverId + ":" + username + ":" + timestamp;
Mac mac = Mac.getInstance("HmacSHA256");
mac.init(new SecretKeySpec(secret.getBytes(UTF_8), "HmacSHA256"));
String expected = Hex.encodeHexString(mac.doFinal(data.getBytes(UTF_8)));
boolean valid = MessageDigest.isEqual(expected.getBytes(), signature.getBytes());

Reply with HTTP 200 within 10 seconds. Any other status is logged as a failure and retried with backoff; you can also retry manually from your dashboard callback log.

Store the vote_id. Retries reuse the same id, so ignore ids you have already rewarded to avoid double payouts.

Signature mismatch usually means the secret was copied with whitespace, or the fields were concatenated in a different order. Timeouts usually mean your callback endpoint is doing heavy work inline — queue the reward and return 200 immediately.