Documentation
Everything Montvo gives a developer, from a tag you paste once to an API you call from your own server. Start with whichever describes what you have built.
One tag before </body>. Every outbound link on your pages becomes a paid link, including ones added after load.
The one call the tag makes, documented for pages the tag cannot reach — server-rendered HTML, a static build, a native app.
Links, stats, unlocks and payouts as JSON, plus signed webhooks for every event a key can be told about.
Check from your own server that a particular visitor finished the gate, before you hand them anything for it.
The two keys
Every call is authenticated with Authorization: Bearer … and one of two keys. They are not interchangeable, and the difference is the whole of the security model.
| Site key | Secret key | |
|---|---|---|
| Looks like | pk_live_… | sk_live_… |
| Lives in | A public page, where anyone can read it. | Your server, and nowhere else. |
| Can do | Create links, through one endpoint. | Everything: links, stats, payouts, account. |
| Limit | 3,000 calls a minute | 600 calls a minute |
| If it leaks | A stranger can make links that pay you. Rotate it if you would rather. | Rotate it immediately. |
One live key of each kind
What the REST API covers
Everything below is served from https://montvo.com/api/v1 and takes a secret key. Each one is written out on the reference. Your keys, and a live log of every call made with them, are on the Developers screen.
| Method | Path | What it does |
|---|---|---|
POST | /links | Make a paid link. |
GET | /links | List yours, newest first. |
GET | /links/:slug | One link. |
DELETE | /links/:slug | Remove one, and its history. |
GET | /links/:slug/stats | Unlocks and earnings, by window. |
GET | /unlocks/:token | Whether one visitor finished. |
POST | /unlocks/:token/claim | The same, and only once. |
GET | /unlocks | Finished trips under one reference. |
GET | /payouts | Balance and what has been sent. |
GET | /me | Who the key belongs to. |
Webhooks
Point one HTTPS endpoint at your server and Montvo posts to it as things happen. Every delivery is signed with an HMAC over the timestamp and the body together, so a captured delivery cannot be replayed at you later.
link.created— a link is created. From the dashboard, the API or your site script.unlock.recorded— an unlock is paid. Thousands a day on a busy link.payout.sent— your payout is sent. Every Friday, once the BTC is on its way.referral.joined— someone joins with your link. A new creator under your referral link.
The payloads and the signature check are on the reference; the endpoint itself, its secret and the event picker are on the Developers screen.
Limits, and what is kept
| Figure | |
|---|---|
| Calls a minute, secret key | 600 |
| Calls a minute, site key | 3,000 |
| Addresses per script call | 50 |
| Request log kept | 7 days |
| Webhook delivery log kept | 7 days |