Partner panel

PartnerApi backs the panel at https://panel.hular.dev. Everything it exposes is scoped to one partner: your keys, your orders, your referral earnings. It is a separate service from BlinkApi and uses session tokens rather than API keys.

Signing in

There is no password. Request a code by email, verify it, then confirm with a code from an authenticator app (TOTP). Every account must enroll an authenticator; the first sign-in after that requirement returns a secret to import into Google Authenticator or any TOTP app, by QR code or by typing it in. Requesting a code requires a Cloudflare Turnstile token, minted by the widget on the panel’s sign-in form.

const { partner } = createBlinkClient({ token: () => session });

await partner.requestLoginCode({ email, captchaToken });

const login = await partner.verifyLoginCode({
  email,
  code: "123456",
  keepSignedIn: false,
});

if (!login.totpEnrolled) {
  const enrollment = await partner.beginTotpEnrollment({
    challenge: login.challenge,
  });
  enrollment.otpauthUrl; // render as a QR code
  enrollment.secret;     // or show for manual entry
}

const created = await partner.completeLogin({
  challenge: login.challenge,
  code: "654321",        // from the authenticator app
});

created.token;       // send as: authorization: Bearer <token>
created.expiresAt;   // when it stops working

Rule	Value
Code lifetime	10 minutes
Wrong attempts before the code is discarded	5
Challenge lifetime between email code and authenticator code	5 minutes
Wrong authenticator codes before the challenge is discarded	5
Session lifetime	1 day
Session lifetime with `keep_signed_in`	180 days

Requesting codes in quick succession is throttled: a second request inside a minute is rejected rather than sending another email. Turnstile tokens are single-use and short-lived, so each request needs a fresh one; deployments without a configured Turnstile secret skip the check. Every other PartnerApi call needs the token in an authorization: Bearer header. An expired or unknown token returns UNAUTHENTICATED. Logout invalidates the session immediately.

With Telegram or a wallet

Once an account has connected Telegram or a wallet (see Sign-in methods), it can sign in with either instead of email. Both open the same login challenge as the email code, so the authenticator step and the session that follows are unchanged. For Telegram, open the bot link, press Start, and type the six-digit code the bot replies with:

const link = await partner.startTelegramLogin({});
link.botUrl;   // open it, or render it as a QR code

const login = await partner.finishTelegramLogin({
  token: link.token,
  code: "123456",        // from the bot
  keepSignedIn: false,
});

For a wallet, sign a Sign-In with Ethereum message with the connected EVM wallet:

import { LoginPanel, signEvmMessage } from "@mayanfinance/blink-sdk";

const request = await partner.startWalletLogin({
  address,
  panel: LoginPanel.PARTNER,
});
const signature = await signEvmMessage(provider, address, request.message);

const login = await partner.finishWalletLogin({
  nonce: request.nonce,
  signature,
  keepSignedIn: false,
});

Then call completeLogin with login.challenge and an authenticator code, as for email. An account without an authenticator cannot sign in this way; it signs in with email and enrolls one first.

Rule	Value
Telegram link and code lifetime	10 minutes
Wrong Telegram codes before the code is discarded	5
Time allowed to sign a wallet message	5 minutes

API keys

const me = await partner.getPartner({});

me.email;
me.keys;      // existing keys
me.maxKeys;   // cap on active keys

RPC	Effect
`CreatePartnerApiKey`	Creates a named key and returns it, including the secret.
`RevokePartnerApiKey`	Revokes by id. Requests using it then fail as disabled.

The key value is returned on the key objects, so a partner can retrieve an existing key rather than rotating when it is misplaced. Treat it as a secret regardless: it carries your rate limit and your attribution. Key changes are cached briefly on the API side, so a new or revoked key takes a few seconds to take effect. See API keys.

Usage

The Usage tab charts your API traffic per key: requests over time split by status (ok, rate limited, error), rate limit points consumed, and a per-method breakdown of calls and errors. Use it to see which methods are eating your budget and whether you are hitting the limit. The same data is available programmatically:

const stats = await partner.getPartnerApiStats({
  rangeSecs: 86400n,
  stepSecs: 300n,
});

stats.requests;   // per key, method, and status
stats.points;     // rate limit points consumed per key

See GetPartnerApiStats for the bounds on range and step, and API keys for how points and costs work. The Sign-in methods tab lists the account’s email, its connected Telegram account, and its connected wallets. An account can connect one Telegram account and up to 5 EVM wallets, and each of them can belong to one account only. Connecting or removing a method asks for an authenticator code first, so a stolen session token alone cannot add a way in or remove one. Each call needs its own code, since a code that was already accepted is refused until the next one appears, and after 5 wrong codes the session is closed.

const telegram = await partner.startTelegramLink({ totpCode: "654321" });
telegram.botUrl;   // open it and press Start; the bot replies with a code
await partner.finishTelegramLink({ token: telegram.token, code: "123456" });

const request = await partner.startWalletLink({ address, totpCode: "112233" });
const signature = await signEvmMessage(provider, address, request.message);
await partner.finishWalletLink({ nonce: request.nonce, signature });

const me = await partner.getPartner({});
me.loginMethods;   // each with id, kind, subject, label, createdAt

await partner.removeLoginMethod({
  id: me.loginMethods[0].id,
  totpCode: "445566",
});

Only externally owned accounts can sign; contract wallets such as a Safe are not supported. Email cannot be removed. Removing a method does not end the sessions it opened; revoke those under Sessions.

Sessions

The Sessions tab lists every live sign-in on the account: the device it came from, every IP it has been used from with a best-effort location, when it was created, when it was last active, and when it expires.

const page = await partner.listPartnerSessions({});

for (const session of page.sessions) {
  session.userAgent;
  session.ips;         // every address the session was used from
  session.lastUsedAt;
  session.current;     // the session making this call
}

await partner.revokePartnerSession({ id: page.sessions[1].id });

A session can revoke the account’s other sessions only once it is at least 6 hours old, so a freshly stolen token cannot immediately evict you; can_revoke on the listing says whether yours qualifies. Revoking your own current session is Logout.

Your orders

ListPartnerOrders returns orders attributed to your keys, newest first, cursor-paginated.

const page = await partner.listPartnerOrders({ limit: 50n });

for (const order of page.items) {
  order.quoteHash;
  order.state;
  order.srcChain;
  order.dstChain;
  order.depositAmount;
  order.depositSymbol;
  order.referrerFee;
  order.apiKeyName;   // which key originated it
}

api_key_name is what makes this useful across surfaces: issue one key per application and the attribution comes back for free.

Referrals and vouchers

RPC	Returns
`GetPartnerReferrals`	Claimable balances grouped by referrer, chain, and token.
`ClaimPartnerReferrer`	A signed voucher for one balance, marking its orders claimed.
`ListPartnerVouchers`	Every voucher issued to you, with redemption status.
`BuildVoucherRedemption`	A prepared redemption transaction for a voucher and payer.

See Referral program for what the voucher is and how redemption works on each chain.

Do not embed a partner session token in a client application. It grants key management and claiming. Sessions belong in the panel or in a backend you control.

Get started

Build a swap

Extend

Partner panel

Signing in

With Telegram or a wallet

API keys

Usage

Sessions

Your orders

Referrals and vouchers

​Signing in

​With Telegram or a wallet

​API keys

​Usage

​Sign-in methods

​Sessions

​Your orders

​Referrals and vouchers

Signing in

With Telegram or a wallet

API keys

Usage

Sign-in methods

Sessions

Your orders

Referrals and vouchers