Connect users with OAuth

Published on August 2026

Reading Time: 6 Minutes

By Coinpes Team

Open a demo wallet and trade the same 1.95× payout rules — no slideware.

Introduction

Partner trading uses OAuth 2.0 with PKCE. The browser starts login. Your backend exchanges the authorization code and stores tokens for that user. The client secret never belongs in a mobile app, SPA, or frontend bundle.

PKCE ties the token request to the same client that opened the authorize page. Without it, a stolen code could be exchanged by someone else. Coinpes requires the S256 challenge on every authorize request. There is no implicit grant.

Before you start

  1. Enroll as a partner in Referrals so first-time consent can attach the referral.
  2. On that page, open Apps and choose Create App. Pick Sandbox (partner_test_*) or Live (partner_live_*), add redirect URIs, and copy the client id and secret immediately — the secret is shown once.
  3. Redirect URIs must match exactly: scheme, host, port, and path. A trailing-slash mismatch fails the redirect.
  4. Decide scopes. Typical trading apps need trade:read, trade:write, account:read, market:read, and profile:read. Timed contracts also need contract:read and contract:write.

Authorization request

On the server (or a confidential mobile backend), generate a high-entropy code_verifier and the S256 code_challenge. Store the verifier next to the pending login (signed cookie or server session), not in localStorage on a public page.

Redirect the user to /oauth/authorize with client_id, redirect_uri, response_type=code, scope, code_challenge, and code_challenge_method=S256. Request only the scopes you will use — extra scopes make consent harder to approve.

Token exchange

After allow, Coinpes redirects to your URI with a one-time code. Your server calls POST /oauth/token with JSON: grant_type, code, code_verifier, client_id, client_secret, and the same redirect_uri. Do not send Basic auth.

Persist the access token for /v1 calls and the refresh token to rotate before expiry. Treat both as secrets: encrypt at rest, never log them, revoke when the user disconnects Coinpes in your product.

Consent also attributes the referral

You do not pass ?ref= during OAuth for users who authorize your app. On allow, Coinpes links them to your partner if they were not already referred elsewhere. Share your signup link for people who are not going through OAuth. First-touch wins; you cannot retag someone who already belongs to another partner.

Common failures

  • Redirect URI not in the allow-list, or HTTP vs HTTPS mismatch.
  • Reusing a code (they are one-time) or a verifier from a different login attempt.
  • Putting client_secret in the app binary. Rotate it from Referrals → Apps if it leaked.

Never put client_secret in a mobile app, SPA, or frontend bundle. PKCE is required; the secret stays on the server.

Parameter lists and examples: OAuth & PKCE reference.

Frequently asked questions

Where do I get a client id and secret?
Enroll as a partner, then create an app under Trade → Referrals → Apps. Copy the secret once.
Can I create users with the Partner API?
No. Users sign in or register during the OAuth redirect. There is no user-provisioning endpoint.
Why is PKCE required?
PKCE proves your token request belongs to the same client that started the login. It stops authorization-code interception.
Can I put the client secret in a mobile app?
No. Keep partner_live_* / partner_test_* secrets on your server. The app only starts the authorize redirect.

Contact us

Get help with Coinpes trading and accounts

Whether you are learning contracts on demo, funding a live wallet, or need help with positions and payouts, tell us what you need and our team will follow up.

By submitting this form, you agree to Coinpes's Terms of Use and acknowledge our privacy information.