Network API and webhooks

Settings has a card called API and webhooks. Mint a key there to read this network from your own bot, your own site, or your staff panel, and register an endpoint to receive alerts as they happen.

#Keys and scopes

A key is shown once, because we store only a digest of it. It carries the scopes you tick, and a route it has no scope for answers 403. Revoking a key stops it on its next request.

The budget is 600 requests a minute per key. Every answer carries the remaining count and the second the window rolls over.

GET /api/v1/network/overview?range=7d
Authorization: Bearer mca_api_...

#What you can read

Every answer is the same envelope: the payload under data, the request under meta. A list carries total and next, and next is the offset of the following page or null at the end.

#CSV export

Three files, all on the read:export scope: sessions.csv and purchases.csv take from and to as ISO stamps, and players.csv is the whole roster. Timestamps are UTC, files stream rather than building in memory, and one file carries at most 100,000 rows.

No IP hash and no secret is ever written to a file.

curl -H "Authorization: Bearer $MCA_KEY"   "https://app.mcanalytics.net/api/v1/network/export/sessions.csv?from=2026-08-01T00:00:00Z&to=2026-09-01T00:00:00Z"   -o sessions.csv

#Outgoing webhooks

Register an https endpoint and pick the events it wants: the five alert rules, the weekly digest, and a first heartbeat. Each delivery is signed, retried three times, and logged. Twenty failures in a row switch the endpoint off.

Verify the signature over the raw body before you parse it. The key is the SHA-256 digest of the secret we showed you once.

import { createHash, createHmac, timingSafeEqual } from "node:crypto";

const key = createHash("sha256").update(process.env.MCA_WEBHOOK_SECRET).digest("hex");

export function verify(rawBody, header) {
  const expected = "sha256=" + createHmac("sha256", key).update(rawBody).digest("hex");
  const a = Buffer.from(expected);
  const b = Buffer.from(header ?? "");
  return a.length === b.length && timingSafeEqual(a, b);
}