Badges
Badges are small "achievement" tags that show up on a player's public profile - think of them like a trophy card with a name and description. Staff can hand a badge to a player by hand, or set a badge up to follow a LuckPerms rank automatically, so players get (or lose) it the moment their rank changes - no staff action needed. For example, you could set up an "Alumni Staff" badge that stays in sync with a retired-staff rank on its own.
📸 Screenshot: A player profile page showing a row of earned badge cards
How Players See Them​
Badges appear automatically on a player's profile page wherever their earned badges are rendered. Players cannot request or manage badges themselves - every badge is either granted manually by staff or earned automatically by holding a linked LuckPerms group. There are no player-facing controls.
For Staff​
Badges are managed from Dashboard → Badges (requires zander.web.badges).
📸 Screenshot: The badges list with create, edit, duplicate, and assign actions per row
Creating a Badge​
| Field | Description |
|---|---|
| Name | Required, up to 100 characters |
| Description | Shown on the badge card |
| Background Color | 6-digit hex code |
| Text Color | 6-digit hex code, defaults to #ffffff |
| LuckPerms Group | Optional - linking a group enables auto-sync |
Use Duplicate to quickly spin up a variant of an existing badge - it copies all fields except the LuckPerms group link, which is cleared so you don't accidentally double-sync two badges to the same rank.
Assigning Badges Manually​
The Assign page includes a user autocomplete (searches by username, minimum 2 characters). Manually assigned badges are flagged internally so the LuckPerms sync job never touches them - you can safely hand out a one-off badge without worrying about it being revoked later.
Automatic LuckPerms Sync​
If a badge has a linked LuckPerms Group, a background job runs every 15 minutes and:
- Grants the badge to every player currently holding that LuckPerms group
- Revokes the badge from players who lost the group
Manually assigned badges are never touched by this sync - only badges the job itself granted are eligible for automatic revocation.
Feature Toggle​
Badges have no dedicated feature flag - the module is always active. The dashboard requires zander.web.badges. All API routes (including the public profile-read endpoint) require the shared x-access-token like every other API route in this app - "public" here means no additional permission check beyond that token, not that it's open to unauthenticated callers.