Developers
JSON Route Handlers under /api/*. Pages never call API-Football from the browser — only /api/sync does, with CRON_SECRET.
Auth session routes use Supabase cookies from magic link or Google sign-in.
GET/api/healthAuth: None
Service health, phase, Supabase/API-Football flags, and sync hints.
GET | POST/api/sync?job=players|fixtures|allAuth: Bearer CRON_SECRET
Server-only API-Football → Supabase sync for every player with api_football_id (profiles/seasons or club fixtures).
GET | POST/api/players/world?region=all&maxTeams=10Auth: Bearer CRON_SECRET
Bulk-import squads from 45+ clubs worldwide (1 API call/team). Add sync=true for per-player stats (uses many API calls).
GET | POST/api/players/catalogAuth: Bearer CRON_SECRET
Seed marquee players from starter catalog (Messi, Ronaldo, Kane, etc.) and sync each.
POST/api/players/importAuth: Bearer CRON_SECRET
Body `{ apiFootballId, slug? }` — import one player from API-Football and sync.
GET/api/playersAuth: None
Database player count + featured comparison summary.
GET/api/search?q=&limit=Auth: None
Player search autocomplete — Supabase full-text search (min 2 chars, never Football API).
GET/api/statsAuth: None
Career + season stats for both players.
GET/api/matchesAuth: None
Recent player appearances (up to 5 each) and live-score cards.
GET/api/votesAuth: None (public tallies)
Community vote tallies; signed-in users also see their vote.
POST/api/votesAuth: Session cookie
Body `{ choice: 'haaland' | 'mbappe' }` — upsert one vote.
GET/api/predictionsAuth: None (summaries)
Upcoming match prediction summaries.
POST/api/predictionsAuth: Session cookie
Upsert scoreline + optional first-scorer prediction.
GET/api/comments?entityType=&entityId=Auth: None
List comments for player | compare | news | prediction entities.
POST/api/commentsAuth: Session cookie
Create a comment (`entityType`, `entityId`, `body`).
DELETE/api/commentsAuth: Session cookie
Delete your own comment.
POST/api/likesAuth: Session cookie
Toggle like on a comment (`commentId` UUID).