Generate or rotate an app's backend secret
Returns a `pidsk_…` secret **once** — only its SHA-256 hash is stored, so an existing secret can never be read back, only replaced. Afterwards, code exchange for this app requires the secret. Backend-only: never ship it in frontend code. Owners only.
Returns a pidsk_… secret once — only its SHA-256 hash is stored, so an
existing secret can never be read back, only replaced. Afterwards, code
exchange for this app requires the secret. Backend-only: never ship it in
frontend code. Owners only.
Authorization
cookieAuth JWT access token set by /auth/google/callback or /auth/refresh
In: cookie
Path Parameters
uuidResponse Body
application/json
application/json
application/json
curl -X POST "https://example.com/apps/497f6eca-6276-4993-bfeb-53cbbbba6f08/secret"{ "secret": "pidsk_9f2c…", "prefix": "pidsk_9f2c41"}Register a third-party app POST
Registers an app for "Sign in with PeridotID" and returns its public `client_id`. Pass just a name — allowed origins are managed after via PATCH (the exact return URL is passed in code at login time). Authenticated — the caller becomes the app owner.
Set the app's ledger-callback endpoint POST
PeridotID POSTs signed ledger events here (e.g. `fiat.transfer.posted` when funds land on this app's escrow account). Returns a `pidwh_…` HMAC signing secret **once**; every callback carries `X-Pid-Signature: sha256=<hex>` over the raw body and `X-Pid-Event`. https required (http allowed for localhost). Owners only.