Partner API & webhooks

<timestamp>
<METHOD upper case>
<path as sent, e.g. /api/v1/integrations/v1/events>
<canonical query: decode, sort by name then value, RFC 3986 encode (space = %20), join name=value with &>
<hex sha256 of the raw body; e3b0c442…b855 for an empty body>

KEY=mdk_5f1c2a9e8b7d6c4a3f2e1d0c
SECRET=mdsk_EXAMPLE_ONLY_q7Xv2Lr9TzK4mWb8Np3Hs6Df1Gj5Yc0A
HOST=https://api.midas.exchange
TS=$(date +%s)

# GET with a query — write the query already canonical (sorted, RFC 3986).
P=/api/v1/integrations/v1/events
Q='after=1200&limit=2&types=deposit.confirmed%2Cuser.kyc_verified'
BODY_SHA=$(printf '%s' '' | openssl dgst -sha256 -hex | awk '{print $NF}')
SIG=$(printf '%s\n%s\n%s\n%s\n%s' "$TS" GET "$P" "$Q" "$BODY_SHA" | openssl dgst -sha256 -hmac "$SECRET" -hex | awk '{print $NF}')
curl -sS "$HOST$P?$Q" -H "X-MIDAS-KEY: $KEY" -H "X-MIDAS-TIMESTAMP: $TS" -H "X-MIDAS-SIGNATURE: $SIG"

# POST — sign the exact bytes you send.
P=/api/v1/integrations/v1/rewards/grants
BODY='{"user_id":"9e2b7d14-0c6a-4b38-8f5e-1a4d6c0b3e92","type":"fee_credit","amount":"2","ttl_days":30,"reference":"promo-2026-10-0001"}'
BODY_SHA=$(printf '%s' "$BODY" | openssl dgst -sha256 -hex | awk '{print $NF}')
SIG=$(printf '%s\n%s\n%s\n%s\n%s' "$TS" POST "$P" "" "$BODY_SHA" | openssl dgst -sha256 -hmac "$SECRET" -hex | awk '{print $NF}')
curl -sS -X POST "$HOST$P" -H 'Content-Type: application/json' -d "$BODY" \
  -H "X-MIDAS-KEY: $KEY" -H "X-MIDAS-TIMESTAMP: $TS" -H "X-MIDAS-SIGNATURE: $SIG" \
  -H "X-MIDAS-IDEMPOTENCY-KEY: grant-promo-2026-10-0001"

{"success":true,"data":{"events":[
  {"id":1802,"type":"user.kyc_verified","user_id":"9e2b7d14-…","occurred_at":"2026-10-04T09:05:00Z","data":{"kyc_level":1}},
  {"id":1834,"type":"deposit.confirmed","user_id":"9e2b7d14-…","occurred_at":"2026-10-04T09:20:00Z",
   "data":{"asset":"USDT","amount":"250","amount_usd":"250","wallet_type":"spot"}}],
 "next_after":1834,"has_more":true}}
// Keep next_after even from an empty page: it advances to the settled horizon.

POST /rewards/grants
{"user_id":"9e2b7d14-…","type":"fee_credit","amount":"2","ttl_days":30,"reference":"promo-2026-10-0001"}

201 {"success":true,"data":{"replayed":false,"grant":{"id":"6b1f0e2a-…","reference":"promo-2026-10-0001",
  "user_id":"9e2b7d14-…","type":"fee_credit","amount":"2","granted_amount":"2","usd_value":"2","ttl_days":30,
  "expires_at":"2026-11-03T09:20:00Z","program_code":"partner_api","created_at":"2026-10-04T09:20:00Z"}}}

// points: {"type":"points","amount":500,…} → usd_value "0.5" at the default rate (1,000 points = 1 USD)

POST <your url>
Content-Type: application/json
User-Agent: Midas-Webhooks/1
X-Midas-Event-Id: 1834
X-Midas-Event-Type: deposit.confirmed
X-Midas-Delivery-Id: 5c2e…
X-Midas-Attempt: 1
X-Midas-Signature: t=1791105600,v1=98f791c88dfa79554362f36881b6dcc2f264bda8af28466bf4fc89bdf53d1d79

{"id":1834,"type":"deposit.confirmed","occurred_at":"2026-10-04T09:20:00Z","user_id":"9e2b7d14-0c6a-4b38-8f5e-1a4d6c0b3e92","data":{"amount":"250","amount_usd":"250","asset":"USDT","wallet_type":"spot"}}

const crypto = require("crypto");
// Express: app.post("/midas", express.raw({ type: "application/json" }), handler)
function verifyMidasSignature(header, rawBody, secret, toleranceSec = 300) {
  const fields = header.split(",").map((p) => p.trim().split("="));
  const t = (fields.find(([k]) => k === "t") || [])[1];
  const sigs = fields.filter(([k]) => k === "v1").map(([, v]) => v);
  if (!t || sigs.length === 0 || Math.abs(Math.floor(Date.now() / 1000) - Number(t)) > toleranceSec) return false;
  const expected = crypto.createHmac("sha256", secret).update(t + ".").update(rawBody).digest();
  return sigs.some((s) => { const b = Buffer.from(s, "hex"); return b.length === expected.length && crypto.timingSafeEqual(b, expected); });
}

import hashlib, hmac, time

def verify_midas_signature(header: str, raw_body: bytes, secret: str, tolerance: int = 300) -> bool:
    fields = [p.strip().split("=", 1) for p in header.split(",") if "=" in p]
    t = next((v for k, v in fields if k == "t"), None)
    sigs = [v for k, v in fields if k == "v1"]
    if t is None or not sigs or abs(time.time() - int(t)) > tolerance:
        return False
    expected = hmac.new(secret.encode(), t.encode() + b"." + raw_body, hashlib.sha256).hexdigest()
    return any(hmac.compare_digest(expected, s.lower()) for s in sigs)