Decisions
Every presentation your test customers answered, with the signed record and what your policy did.
No requests yet
Create one and answer it with the test wallet. It takes about a minute.
Policy
What your bank does for each transaction and risk class. Changes apply to new requests at once.
After consent
If the situation changes after the customer shared (a call starts, someone takes remote control), the wallet sends a follow-up.
When the record is missing
A wallet that should send a context record but did not.
Try your policy
See what happens before you save.
Webhooks
We send each decision to your HTTPS endpoint the moment it is made, signed so you can check it came from us.
Endpoint
Signing secret, shown once:
Check the signature
Header Calmproof-Signature: t=<unix>,v1=<hex>. Compute HMAC-SHA256 over t + "." + body with your secret and compare in constant time.
Event log
The same events are available at GET /v1/eventsAPI keys
Keys belong on your server. Each request is authenticated with Authorization: Bearer.
Rotate your key
Issues a new key and revokes every current key at once. Use it when a key may have leaked.
New key, shown once. This tab already uses it.
How keys are kept
- Stored only as a keyed hash, so a database copy reveals no key.
- Shown once, at creation or rotation.
- Limited to 300 calls a minute per organisation in the sandbox.
- In this console, held in this tab only and gone when you close it.
Developers
Two calls: create a request, read the decision. Everything else is optional.
Same device
Your app opens wallet_url directly. Use "channel": "same_device".
Another device
Show wallet_url as a QR code on the web page. Use "channel": "cross_device"; the wallet checks it was scanned nearby.