Track your flights, store flown routes over time, and view them in a wrapped flat map or globe view.
Authentication is handled by:
- Discord OAuth
- Passkeys (WebAuthn), after a user has signed in once and enrolled one
SimpelSimConnect is used for:
- reading live public pilot data from the VATSIM data feed
VATSIM API will be added again:
- Coming sson
- Discord OAuth sign-in
- Optional passkey sign-in after enrollment
- VATSIM CID linking
- Live SimConnect flight tracking
- Historical route map and density map
- Wrapped flat-map rendering for long-haul routes
- Globe view
- SimBrief route overlay
- Flight history and route statistics
vatsim-heatmap/
|-- backend/
| |-- app.py
| |-- requirements.txt
| |-- flights.db
| `-- .env.example
`-- frontend/
|-- index.html
|-- link-vatsim.html
|-- dashboard.html
`-- roadmap.html
- Open Discord Developer Portal
- Create an application
- Add an OAuth redirect URI:
http://localhost:5000/auth/callback - Copy the client ID and client secret
Create backend/.env from backend/.env.example.
Minimum local setup:
DISCORD_CLIENT_ID=your_discord_client_id
DISCORD_CLIENT_SECRET=your_discord_client_secret
DISCORD_REDIRECT_URI=http://localhost:5000/auth/callback
PUBLIC_BASE_URL=http://localhost:5000
SECRET_KEY=replace_with_a_long_random_secret
ALLOWED_DISCORD_IDS=123456789012345678Optional variables:
SIMBRIEF_USERNAME=
SIMBRIEF_USERID=
SIMCONNECT_TELEMETRY_TOKEN=
PASSKEY_RP_ID=localhost
PASSKEY_ORIGIN=http://localhost:5000
PASSKEY_RP_NAME=VATSIM HeatTracker
VATSIM_CACHE_TTL_SECONDS=15
SIMBRIEF_CACHE_TTL_SECONDS=300
TRACKER_POLL_SECONDS=20
TRACKER_MIN_INSERT_SECONDS=10Notes:
ALLOWED_DISCORD_IDSis a comma-separated allowlist of Discord user IDs.PASSKEY_RP_IDandPASSKEY_ORIGINshould match the real site hostname and origin in production.- Passkeys require HTTPS in production.
cd backend
python -m venv venv
source venv/bin/activate
pip install -r requirements.txtOn Windows PowerShell:
cd backend
python -m venv venv
.\venv\Scripts\Activate.ps1
pip install -r requirements.txtFrom the project root:
python backend\app.pyThe app runs on:
- Sign in with Discord
- If your Discord ID is allowed, your account session is created
- Link your VATSIM CID on
/link-vatsim - Optionally add a passkey for future sign-ins
- Open
/dashboardto view live and historical data
- The backend polls the VATSIM public data feed on a background interval
- For every linked VATSIM CID currently online, it records position snapshots
- Snapshots are written into
flight_points - Flights are grouped into
flights /api/heatmapbuilds route segments, dense nodes, and recent tracks from stored points
GET /auth/login- start Discord OAuthGET /auth/callback- Discord OAuth callbackGET /auth/logout- end sessionGET /api/me- current logged-in userPOST /api/passkey/register/options- start passkey registrationPOST /api/passkey/register/verify- finish passkey registrationPOST /api/passkey/auth/options- start passkey loginPOST /api/passkey/auth/verify- finish passkey login
POST /api/link-vatsim- link a VATSIM CIDPOST /api/unlink-vatsim- unlink the VATSIM CID
GET /api/live- current live flight state for the linked CIDGET /api/heatmap- stored route and density dataGET /api/flights- recent flightsGET /api/stats- totals and top routesGET /api/simbrief- latest SimBrief summary and route overlayPOST /mcp- remote MCP endpoint for ChatGPT/API clientsGET /.well-known/oauth-protected-resource- MCP OAuth resource metadataGET /.well-known/oauth-authorization-server- OAuth authorization server metadataPOST /oauth/register- dynamic client registration for MCP clientsGET /oauth/authorize- OAuth authorization code flow for MCP clientsPOST /oauth/token- OAuth token exchange for MCP clients
users- Discord account identity plus linked VATSIM CIDpasskeys- enrolled WebAuthn credentialsflight_points- recorded VATSIM position snapshotsflights- tracked flight sessions
- Use a production WSGI server instead of Flask debug serving
- Set a strong
SECRET_KEY - Set
DISCORD_REDIRECT_URIto your public callback URL - Set
PASSKEY_RP_IDandPASSKEY_ORIGINto the production domain - Serve over HTTPS, especially for passkeys
- Keep
ALLOWED_DISCORD_IDSrestricted to the users who should access the tracker
All source files in this repository, including C#, HTML, CSS, JavaScript, and documentation, are licensed under the PolyForm Noncommercial License 1.0.0 unless otherwise stated.
Commercial use is prohibited without written permission from the copyright holder.