Introduction
Partner integrations fail most often from leaked secrets, missing PKCE, or treating user tokens like public API keys. Treat every credential as scoped to one partner and one user.
Assume anything that reached a browser, crash report, or chat log is public. Rotate it. Do not wait to see abuse.
Credential types
- OAuth client — id + secret, server only, used at
POST /oauth/token. Live and sandbox are different secrets. - User access token — Bearer header on
/v1and WebSocket bootstrap. Short-lived. Refresh on the server. - Webhook signing secret — HMAC for inbound POSTs. Separate from OAuth. Shown once when you create the endpoint in Referrals.
Rules
- PKCE on every authorize request. No implicit grant.
- Rotate refresh tokens; revoke on logout in your product.
- Send
Idempotency-Keyon writes so retries cannot double-fill. - Respect rate limits; back off on 429 instead of retrying immediately.
- Never log tokens, secrets, raw authorization codes, or full webhook bodies in shared log drains.
- Verify webhook HMAC before you parse business fields. Use Test in Referrals to prove verification without a live trade.
PII
Partner routes do not return trader email or phone. Dashboard trader lists use anonymized ids. Do not try to join those ids to your CRM unless the user gave you that data in your own app.
If something leaks
In Referrals, open the app and choose Rotate secret. Copy the new secret into server env. Create a new webhook endpoint (or rotate the webhook secret on that page) and update your handler. Invalidate stored user refresh tokens. Assume any token that appeared in a client bundle is compromised.
If a secret leaks, rotate it from Referrals → Apps and rotate the webhook secret on the same page. Assume any token that appeared in a client bundle is compromised.
Errors and limits: Errors · Rate limits · Credential types.
Frequently asked questions
What happens if a secret leaks?
Does the Partner API return email or phone?
Should I log access tokens?
Related guides
6 MINUsing the Partner API
What the Partner API is for, how a user session works, and what still lives in the Referrals dashboard.
6 MINConnect users with OAuth
Let traders sign in or register on Coinpes with OAuth 2.0 and PKCE, then exchange the code on your server.
6 MINPlace trades from your app
List wallets, send idempotent CFD orders, and open timed contracts with a user access token.
5 MINStream prices and positions
Bootstrap the Partner WebSocket, stream quotes and positions, and reconnect after drops.
8 MINReceive webhook events
Register HTTPS endpoints in Referrals, verify HMAC signatures, Test a signed delivery, and process events once.
5 MINTest in sandbox
Use partner_test clients and demo accounts to finish OAuth, trades, sockets, and webhooks safely.
6 MINClone and deploy the example app
Clone the Partner API example from GitHub, reskin it, and deploy the Vite app from Vercel with your OAuth client.
6 MINPartner API reference
Full Partner API reference: OAuth, trading routes, WebSocket, webhooks, and OpenAPI.