The rustplusplus bot needs to receive the same push notifications your phone would: server pairings, smart device pairings, alarms, deaths. A phone gets those because the Rust+ app registered a push identity with Facepunch under your Steam account. The bot has no phone, so this site creates that identity for it. That is all "credentials" are.

What the extension does

1. You click Log In. The extension opens Facepunch's Rust+ login page, the same page the mobile app uses, and you sign in with Steam.
2. Facepunch returns a short-lived auth token and your Steam ID to the page. The mobile app receives them through an internal browser bridge; the extension captures the same message and forwards it to this site's callback.
3. This site's server does, once, what the mobile app does on first launch: it registers a new push identity with Google's Firebase Cloud Messaging and with Expo (the push service the Rust+ app is built on), then tells Facepunch's companion API "send this Steam account's notifications to this identity too", using your auth token.
4. The resulting identity is handed back to your browser as the /credentials add … command. Nothing is kept on the server; see the privacy policy.

The extension runs only on Facepunch's login domain and on this site. It does not read other tabs.

What is in the command

/credentials add gcm_android_id:<id> gcm_security_token:<token> steam_id:<steam id> issued_date:<unix> expire_date:<unix>

• gcm_android_id / gcm_security_token: the push identity. This is what lets the bot open a connection to Google's push service and receive the notifications Facepunch sends to it.
• steam_id: which Steam account the identity belongs to, so the bot knows whose pairings these are and can associate them with your Discord user.
• issued_date / expire_date: when the identity was created and when the auth token behind it expires. The bot uses them to warn you before renewal.

Why 14 days

The auth token Facepunch issues at login is valid for about two weeks; Facepunch's own pairing flow refreshes it on the mobile app because the app is always signed in. The bot cannot re-sign-in with Steam on your behalf, so when the token behind the identity expires, Facepunch stops sending notifications to it. The identity does not "break" visibly: pairings and alarms simply stop arriving. That silent failure is why the display page shows an expiry countdown and why the bot tracks the dates.

Renewing is the same flow again: Log In, copy the new command, run it in Discord. The bot replaces the old identity for your Steam ID.

Teammates

Credentials are per Steam account. If only the bot host registers, only the host's in-game pairings reach the bot. Each teammate who wants to pair servers or devices, or who should be eligible for the leader command, runs the same steps with their own Steam account and their own /credentials add …. The bot keeps one identity per Steam ID.

What someone could do with your credentials

Treat the command like a password for notifications, not for your account.

• Anyone who runs your command in their bot receives the pairing and alarm notifications addressed to your Steam account, and can connect their bot to servers you pair. That is a real leak: they see your team's map data and can flip your smart switches.
• They cannot log in to Steam as you, cannot join servers as you, cannot chat as you, and cannot access your Steam inventory. The credentials contain no Steam password or session.

Run the command only in a channel where the bot can read it and your team can be trusted; the bot deletes it if it has permission. If credentials leak, generate a new set: registering a new identity replaces the old one for that Steam account.

Web version versus the .exe

The older desktop application (rustplusplus Credential Application) does the same registration locally on your PC. It still works but needs an installed program and manual updates. The extension route needs only Chrome or Firefox. Both produce the same command; the bot does not care which you used.

When to regenerate

• The bot stopped receiving pairings or alarms and the /credentials expiry has passed.
• You reinstalled or moved the bot and lost its database.
• You suspect the command was seen by someone outside your team.
• You changed Steam account.

Generate, run the new command, pair again for any devices paired under the old identity.