Skip to main content

​
OTP and webhooks

Card 3-D Secure for agents is never SMS and never Telegram. notify_email style human flags do not mute 3-D Secure for agents.

​
HMAC

IMBA generates the webhook secret (CSPRNG). Plaintext is shown once at register or PATCH. Header is X-IMBA-Signature (HMAC-SHA256 of the raw body), same idea as Partner. Rotate: POST /auth/v1/agent/hmac/rotate — the previous secret dies immediately. Requires a callback_url from register or PATCH. Without a webhook URL the response is 400 callback_url required before rotate. PATCH with a URL mints HMAC (IMBA at-rest key); a 500 unable to complete request was a missing agent/secret_key snapshot bug, not a bad URL. Email-only PATCH does not require a webhook row.

​
x402

/x402/* returns HTTP 402. It is not /api/pin. USDC is not spendable as prepaid USDT until IMBA enables the credit job. Do not treat 402 as a catalog buy.