Developer Hub & Protocols

// Express.js route to redirect the user
app.get('/login', (req, res) => {
  const state = crypto.randomBytes(16).toString('hex');
  req.session.oauth_state = state; // save in session to check later

  const loginUrl = `https://coinbelieve.com/oauth/authorize.php?` +
    new URLSearchParams({
      client_id: process.env.COINBELIEVE_CLIENT_ID,
      redirect_uri: 'https://yoursite.com/callback',
      state: state
    });

  res.redirect(loginUrl);
});

<?php
// PHP script to redirect the user
session_start();
$state = bin2hex(random_bytes(16));
$_SESSION['oauth_state'] = $state;

$params = http_build_query([
    'client_id'    => getenv('COINBELIEVE_CLIENT_ID'),
    'redirect_uri' => 'https://yoursite.com/callback.php',
    'state'        => $state
]);

header('Location: https://coinbelieve.com/oauth/authorize.php?' . $params);
exit;

# Python (Flask example)
from flask import Flask, redirect, session, url_for
import secrets, urllib.parse, os

app = Flask(__name__)

@app.route('/login')
def login():
    state = secrets.token_hex(16)
    session['oauth_state'] = state
    
    params = urllib.parse.urlencode({
        'client_id': os.environ.get('COINBELIEVE_CLIENT_ID'),
        'redirect_uri': 'https://yoursite.com/callback',
        'state': state
    })
    return redirect(f"https://coinbelieve.com/oauth/authorize.php?{params}")

// Node 18+ (Native Fetch)
async function getCoinBelieveUser(authCode) {
  const res = await fetch('https://coinbelieve.com/api/oauth/token.php', {
    method: 'POST',
    headers: { 'Content-Type': 'application/json' },
    body: JSON.stringify({
      client_id: process.env.COINBELIEVE_CLIENT_ID,
      client_secret: process.env.COINBELIEVE_CLIENT_SECRET,
      code: authCode
    })
  });

  const data = await res.json();
  if (!res.ok) {
    throw new Error(data.message || 'Failed to exchange token');
  }

  // Success! Returns user data
  return data;
}

<?php
// PHP cURL token exchange
$payload = json_encode([
    'client_id'     => getenv('COINBELIEVE_CLIENT_ID'),
    'client_secret' => getenv('COINBELIEVE_CLIENT_SECRET'),
    'code'          => $_GET['code']
]);

$ch = curl_init('https://coinbelieve.com/api/oauth/token.php');
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, $payload);
curl_setopt($ch, CURLOPT_HTTPHEADER, ['Content-Type: application/json']);

$response = curl_exec($ch);
$httpCode = curl_getinfo($ch, CURLINFO_HTTP_CODE);
curl_close($ch);

$userData = json_decode($response, true);

if ($httpCode === 200) {
    // Log the user in on your website
    $_SESSION['user'] = $userData;
}

# Python (Requests)
import requests, os

def get_coinbelieve_user(code):
    url = "https://coinbelieve.com/api/oauth/token.php"
    data = {
        "client_id": os.environ.get("COINBELIEVE_CLIENT_ID"),
        "client_secret": os.environ.get("COINBELIEVE_CLIENT_SECRET"),
        "code": code
    }
    
    r = requests.post(url, json=data, timeout=10)
    r.raise_for_status()
    return r.json() # returns dictionary with user details

<?php
function verifyCoinBelieveToken($data, $publicKeyPem, $expectedClientId) {
    // 1. Verify RSA-SHA256 signature
    $signature = base64_decode($data['signature']);
    $valid = openssl_verify(
        $data['user_data_json'],
        $signature,
        $publicKeyPem,
        OPENSSL_ALGO_SHA256
    );

    if ($valid !== 1) {
        throw new Exception('Invalid cryptographic signature.');
    }

    // 2. Check Expiry and Audience
    $claims = json_decode($data['user_data_json'], true);
    $now = time();

    if (($claims['exp'] ?? 0) < $now) {
        throw new Exception('Token has expired.');
    }
    if (($claims['aud'] ?? '') !== $expectedClientId) {
        throw new Exception('Token audience does not match your client_id.');
    }

    return $claims;
}

import json, time, base64
from cryptography.hazmat.primitives import hashes
from cryptography.hazmat.primitives.asymmetric import padding
from cryptography.hazmat.primitives.serialization import load_pem_public_key

def verify_coinbelieve_token(data, public_key_pem, expected_client_id):
    # 1. Verify RSA-SHA256 signature
    pubkey = load_pem_public_key(public_key_pem.encode('utf-8'))
    sig_bytes = base64.b64decode(data['signature'])
    payload_bytes = data['user_data_json'].encode('utf-8')

    pubkey.verify(
        sig_bytes,
        payload_bytes,
        padding.PKCS1v15(),
        hashes.SHA256()
    )

    # 2. Check Expiry and Audience
    claims = json.loads(data['user_data_json'])
    now = int(time.time())

    if claims.get('exp', 0) < now:
        raise ValueError('Token has expired.')
    if claims.get('aud') != expected_client_id:
        raise ValueError('Audience mismatch.')

    return claims

<?php
// callback.php
session_start();

$code  = $_GET['code']  ?? '';
$state = $_GET['state'] ?? '';
$error = $_GET['error'] ?? '';

if ($error === 'access_denied') {
    die('User canceled login.');
}

// Check CSRF state
if (empty($state) || $state !== ($_SESSION['oauth_state'] ?? '')) {
    http_response_code(403);
    die('Invalid state token. Possible CSRF.');
}

// Exchange code for user details
$ch = curl_init('https://coinbelieve.com/api/oauth/token.php');
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, json_encode([
    'client_id'     => getenv('COINBELIEVE_CLIENT_ID'),
    'client_secret' => getenv('COINBELIEVE_CLIENT_SECRET'),
    'code'          => $code
]));
curl_setopt($ch, CURLOPT_HTTPHEADER, ['Content-Type: application/json']);

$rawResponse = curl_exec($ch);
$status      = curl_getinfo($ch, CURLINFO_HTTP_CODE);
curl_close($ch);

$userData = json_decode($rawResponse, true);

if ($status === 200 && isset($userData['id'])) {
    // Log user in
    $_SESSION['user_id']  = $userData['id'];
    $_SESSION['username'] = $userData['username'];
    $_SESSION['email']    = $userData['email'];

    header('Location: /dashboard.php');
    exit;
} else {
    echo 'Login failed: ' . htmlspecialchars($userData['message'] ?? 'Unknown error');
}

# app.py (Flask example)
from flask import Flask, request, redirect, session, jsonify
import requests, os

app = Flask(__name__)
app.secret_key = 'your_app_secret'

@app.route('/callback')
def callback():
    code = request.args.get('code')
    state = request.args.get('state')
    
    # Check state
    if state != session.get('oauth_state'):
        return "Invalid state", 403
        
    # Exchange code
    token_url = "https://coinbelieve.com/api/oauth/token.php"
    res = requests.post(token_url, json={
        "client_id": os.environ.get("COINBELIEVE_CLIENT_ID"),
        "client_secret": os.environ.get("COINBELIEVE_CLIENT_SECRET"),
        "code": code
    }, timeout=10)
    
    if res.status_code != 200:
        return f"Login error: {res.text}", 400
        
    user = res.json()
    session['user'] = user
    return redirect('/dashboard')

if __name__ == '__main__':
    app.run(port=5000)