PlatformsPartner access
Partner access
For platforms that onboard node operators: partner key, sign-up links and the embedded wallet page.
This page is for platforms that onboard node operators. One partner key mints sign-up links for your operators and shows each wallet's protection inside your product. Exchain sets up partner access.
Credentials
| Credential | Used for | Lifetime |
|---|---|---|
| Partner key | /v1/partner/* only | Until Exchain resets or revokes it |
| Webhook signing secret | Verifying webhooks. 32 bytes, hex | Delivered with the partner key |
| Node Token | Co-sign and wallet routes, one per node | Until rotated (the old token stays valid 10 minutes) or revoked |
| Read token | Read routes and the Protected page of one wallet | 15 minutes; expires, cannot be revoked |
The partner key and secret arrive in a one-time link. It opens once and expires after 72 h.
Partner API
Send Authorization: Bearer <partner key>. The rate limit is 120 requests a minute per partner.
| Endpoint | Request | Response |
|---|---|---|
GET /v1/partner | — | { partnerId, name, nodes[], webhook } |
POST /v1/partner/signup-links | { nodeId, returnUrl? } | 201 { url, expiresAt } |
POST /v1/partner/wallets/{walletId}/read-token | — | 201 { url, token, expiresAt } |
- Sign-up links are valid 30 days. Nodes created through one are attributed to you.
returnUrlmust be an origin Exchain allows to frame the page for your account.- A wallet that is not on one of your nodes returns
404.
Embed the Protected page
<iframe src="https://cosign.exchain.network/protected/wal_01J9XK3M4N5P6Q7R8S9T0V1W2Z?t=<read token>"
title="Protected by Exchain" style="width:100%;height:640px;border:0"></iframe>Only origins Exchain allowed for your account can frame it.
| Message from the page | Meaning |
|---|---|
{ type: "exchain:ready", walletId, expiresAt } | Loaded |
{ type: "exchain:read-token-expiring", walletId, expiresAt } | 120 s before the token expires |
{ type: "exchain:read-token-expired", walletId, expiresAt } | The token was refused |
Reply with { type: "exchain:read-token", token } carrying a fresh token from your backend. The page accepts it only from window.parent.