rCTF Docs
Overview

CTFtime

Configure CTFtime OAuth authentication and leaderboard export.

The CTFtime integration adds OAuth-based authentication and leaderboard export in CTFtime’s standard format.

Setup#

Register an OAuth application

Go to your team page on CTFtime and register a new OAuth application. You will receive a client ID (numeric) and a client secret.

Set the callback URL to https://your-ctf-domain.com/integrations/ctftime/callback.

Configure rCTF
rctf.d/ctftime.yaml
ctftime:
clientId: '12345'
clientSecret: your-client-secret

Or via environment variables:

VariableDescription
RCTF_CTFTIME_CLIENT_IDCTFtime OAuth client ID (numeric string)
RCTF_CTFTIME_CLIENT_SECRETCTFtime OAuth client secret

Authentication flow#

  1. The user clicks “Login with CTFtime” on the frontend
  2. The browser redirects to CTFtime’s OAuth authorization page
  3. After approval, CTFtime redirects back with an authorization code
  4. The frontend sends the code to the rCTF API
  5. The API exchanges the code for a CTFtime access token and creates an rCTF CTFtime auth token

Registration with CTFtime#

When a user registers with CTFtime, they provide a team name and the CTFtime token. No email verification is required.

Login with CTFtime#

Returning users provide their CTFtime auth token to log in. The API matches their CTFtime ID to an existing account and returns an rCTF auth token.

Division ACL behavior#

Note

When CTFtime authentication is configured, division ACLs are bypassed entirely. All divisions become available to CTFtime-authenticated users. This is because ACLs are email-based, and CTFtime authentication does not require an email address.

Leaderboard export#

After the CTF ends, you can export the leaderboard in CTFtime’s format for scoreboard submission.

The platform provides a leaderboard export in CTFtime’s JSON format, accessible to users with leaderboardRead permission.

See After the CTF for the full scoreboard submission procedure.

Esc

Start typing to search the docs.