Problem
Define the core challenge
Problem
Supercell's Clash of Clans API requires IP-whitelisted keys, which cannot safely live in a mobile app where users have changing IPs. Players also lack a dedicated mobile tool to explore profiles, compare stats with clan mates, and browse clan war history in one place.
Insight
Securing the IP-locked Supercell API key for mobile clients; designing Cloud Run egress with Direct VPC and Cloud NAT; player ownership verification via in-game API tokens; offline-capable caching without stale data; Play Store compliance with privacy, terms, and account deletion pages.
Target
Design a system that improves speed, usability, and delivery confidence without adding maintenance overhead.
Process
How the work was executed
Discover
A full-stack mobile companion for Clash of Clans players who want clearer stats on the go. The Flutter app surfaces player profiles, detailed statistics, troop and hero breakdowns, clan war logs, capital raid history, and multi-tab player comparisons. Firebase handles authentication and linked-player persistence, while a Node.js proxy on Google Cloud Run keeps the Supercell API key server-side behind a static egress IP.
Build
Built a Flutter app with clean architecture, Firebase Auth, and Firestore-backed player linking, backed by an Express proxy on Google Cloud Run with Cloud NAT static egress, Secret Manager key storage, rate limiting, and token-based player verification. Added multi-tier caching, five-language i18n, and GitHub Pages compliance pages for Google Play.
Validate
Securing the IP-locked Supercell API key for mobile clients; designing Cloud Run egress with Direct VPC and Cloud NAT; player ownership verification via in-game API tokens; offline-capable caching without stale data; Play Store compliance with privacy, terms, and account deletion pages.
Solution
Translate constraints into a scalable solution
Process
A full-stack mobile companion for Clash of Clans players who want clearer stats on the go. The Flutter app surfaces player profiles, detailed statistics, troop and hero breakdowns, clan war logs, capital raid history, and multi-tab player comparisons. Firebase handles authentication and linked-player persistence, while a Node.js proxy on Google Cloud Run keeps the Supercell API key server-side behind a static egress IP.
Solution
Built a Flutter app with clean architecture, Firebase Auth, and Firestore-backed player linking, backed by an Express proxy on Google Cloud Run with Cloud NAT static egress, Secret Manager key storage, rate limiting, and token-based player verification. Added multi-tier caching, five-language i18n, and GitHub Pages compliance pages for Google Play.
Architecture
Flutter client with domain/infrastructure/presentation layers, Riverpod state, and go_router navigation → Cloud Run Express proxy (rate-limited, CORS) → Supercell API via static NAT IP; Firebase Auth and Firestore for user profiles; memory and disk caching with TTL for API snapshots.
Results
Ship measurable outcomes
Results
Production API deployed on Cloud Run (v1.0.0+5); Play Store-ready compliance site on GitHub Pages; five-language mobile app with player comparison, clan war logs, and Firebase-backed account linking.
Impact
Business and product teams gained better reliability, clearer UX behavior, and a stronger foundation for iteration.
Next
The system now supports future features with less rework and more predictable frontend execution.
Tech stack
- Flutter
- Dart
- Riverpod
- Firebase
- Cloud Firestore
- Node.js
- Express
- Google Cloud Run
- Docker
- Supercell API