Skip to Content
DevelopersSecurity

Security

Keeping your token safe

  • Keep your token, and your signing secret if you have one, on your server only. Never put them in a web page or an app.
  • Send the token in the X-CC-Token header, not in a URL.
  • If a token or secret is exposed, CoConnect replaces it in one click and the old one stops working.

Signing requests

Signing proves each request came from your server unchanged, within the last five minutes, and only once. A copied request cannot be altered or sent again. CoConnect gives you a signing secret (ccs_…) on request.

With the SDK (version 1.1 or later), pass the secret and every request is signed for you:

const hub = new CoConnect({ token: process.env.COCONNECT_TOKEN, secret: process.env.COCONNECT_SECRET });

Without the SDK, add two headers:

HeaderValue
X-CC-TimestampThe current time in Unix seconds, for example 1760870400
X-CC-Signaturev1= and the hex HMAC-SHA256 of the string below, keyed with your secret
<timestamp>.<METHOD>.<path and query>.<raw body>

1760870400.POST./api/partner/events.{"event":"ftd","user":"u_1001","amount":75}
  • Sign the exact body you send: serialize the JSON once and send that same string. For GET the body is empty, so the string ends with a dot.
  • Use a new timestamp for every attempt, retries included, and keep your server clock in sync.

Signing is optional while you switch over. Once every call is signed, CoConnect can require it, and unsigned calls are then refused.

Responses and errors

CodeMeaningWhat to do
200Received. Each event shows queued (rewarded within seconds) or duplicateNothing
400Missing event name or user, or more than 50 eventsFix and resend
401Wrong or replaced token, or a bad or expired signatureCheck your token, secret and clock
403Your integration is pausedContact CoConnect
409The same signed request arrived twiceSign each attempt with a new timestamp
429, 503, 5xxToo many requests, events paused, or a temporary errorRetry with backoff; nothing is lost

Send events within five minutes of the action, because members are waiting for their reward.

Reference

Last updated on
Events