Public API & Webhooks

Integrate any system with Cool: read members, posts and payments via REST, and receive real-time events via signed webhooks.

Authentication

Every request uses a cool_… key in the header. Keys are generated in the panel (Super-admin → API & Webhooks) and shown once.

curl https://coolbases.com/api/v1/me \
  -H "Authorization: Bearer cool_SUA_CHAVE"

Endpoints

JSON responses: { "data": [...] } · Errors: { "error": { "status", "message" } } · Keys scoped to a community only see its data.

Webhooks

Register a URL in the panel and pick the events. Each delivery is a signed JSON POST — validate the X-Cool-Signature header (HMAC SHA-256 of the body with your whsec_…).

// payload de exemplo (payment.paid)
{
  "event": "payment.paid",
  "createdAt": "2026-07-05T20:00:00.000Z",
  "data": {
    "paymentId": "pay_abc123",
    "amountCents": 9700,
    "communityId": "com_xyz"
  }
}

// validação da assinatura (Node.js)
const crypto = require("crypto");
const expected = crypto
  .createHmac("sha256", process.env.COOL_WEBHOOK_SECRET)
  .update(rawBody)
  .digest("hex");
const valid = expected === req.headers["x-cool-signature"];