Skip to main content
Onboarding is done manually by the Proof team. There is no self-service signup.

​
What you send to Proof

Email the Proof team with the following: The Proof team configures the rest — supported crypto currencies, destination wallets, widget defaults — based on what you need at onboarding. You do not send these as request parameters.

​
What Proof sends back

Keep client_token secret. Treat it like a password.

​
Authentication

Every request to /widget/* and /ws must include:
All calls must originate from your backend server — never from the browser. The client_token is a server-side secret; exposing it in frontend code allows anyone to impersonate your integration. Proof validates each request against the IP allowlist configured for your partner record. Requests from IPs not on your allowlist are rejected with 403 forbidden. Register all backend server IPs (or CIDR ranges) at onboarding; contact the Proof team to add or remove IPs after that.

​
Token rotation

To rotate your client_token, contact the Proof team. The Proof team will issue a new token and the old token will remain valid for a short grace period during the transition. The internal signing secret used to compute session signatures is rotated by Proof on its own schedule. You never see it and never need to rotate it yourself.