> ## Documentation Index
> Fetch the complete documentation index at: https://api-docs.imbawallet.com/llms.txt
> Use this file to discover all available pages before exploring further.

# OTP and webhooks

> 3-D Secure by email and inbox. HMAC field otp. IMBA generates the secret.

# OTP and webhooks

Card 3-D Secure for agents is **never SMS** and **never Telegram**.

| Channel             | What you get                                                     |
| ------------------- | ---------------------------------------------------------------- |
| Notifications inbox | Always. Payload keeps `code`                                     |
| Email               | If you set `email` on register or `PATCH /auth/v1/agent/webhook` |
| HMAC webhook        | If `callback_url` is set — field **`otp`** (not `code`)          |

`notify_email` style human flags do not mute 3-D Secure for agents.

## HMAC

IMBA generates the webhook secret (CSPRNG). Plaintext is shown **once** at register or PATCH. Header is `X-IMBA-Signature` (HMAC-SHA256 of the **raw** body), same idea as Partner.

Rotate: `POST /auth/v1/agent/hmac/rotate` — the previous secret dies immediately. Requires a `callback_url` from register or PATCH. Without a webhook URL the response is **400** `callback_url required before rotate`. PATCH with a URL mints HMAC (IMBA at-rest key); a 500 `unable to complete request` was a missing `agent/secret_key` snapshot bug, not a bad URL.

Email-only PATCH does not require a webhook row.

## x402

`/x402/*` returns HTTP **402**. It is not `/api/pin`. USDC is not spendable as prepaid USDT until IMBA enables the credit job. Do not treat 402 as a catalog buy.