Network API and webhooks

Settings, Integrations has an API keys block and a Webhooks block. Mint a key there to read this network from your own bot, your own site, or your staff panel, and register an endpoint to receive alerts as they happen.

#Keys and scopes

A key is shown once, because we store only a digest of it. It carries the scopes you tick, and a route it has no scope for answers 403. Revoking a key stops it on its next request.

The budget is 600 requests a minute per key. Every answer carries the remaining count and the second the window rolls over.

The overview and revenue routes take range=24h, 7d, 30d, 90d, 1y or all. 1y and all are charted by the week, and the default is 7d.

GET /api/v1/network/overview?range=7d
Authorization: Bearer mca_api_...

#What you can read

Every answer is the same envelope: the payload under data, the request under meta. A list carries total and next, and next is the offset of the following page or null at the end.

#CSV export

Four files, all on the read:export scope and the Network plan and up: sessions.csv, purchases.csv, and manual-revenue.csv take from and to as ISO stamps, and players.csv is the whole roster. For paged JSON or CSV of players, sessions, purchases, votes and custom events, use the export API. manual-revenue.csv lists the revenue you typed in yourself, with a removed entry kept as a line and the time it was removed in removed_at. Timestamps are UTC, files stream rather than building in memory, and one file carries at most 100,000 rows.

No IP hash and no secret is ever written to a file.

curl -H "Authorization: Bearer $MCA_KEY"   "https://mcanalytics.org/api/v1/network/export/sessions.csv?from=2026-08-01T00:00:00Z&to=2026-09-01T00:00:00Z"   -o sessions.csv

• Export API
• Custom events

#Outgoing webhooks

Register an https endpoint and pick the events it wants (the network must be on Unlimited): the five alert rules, the weekly digest, and a first heartbeat. Each delivery is signed, tried at most three times in all (the first try and two retries), and logged. Twenty failures in a row switch the endpoint off.

The address must be https on port 443 and must resolve to a public host. One network holds ten endpoints and twenty keys, and the same address can be registered once.

The signature arrives in the X-MCA-Signature header as sha256= followed by a hex HMAC. X-MCA-Event names the event and X-MCA-Delivery carries an id that stays the same across retries of one delivery. Verify the signature over the raw body before you parse it. The key is the secret we showed you once, exactly as it was given to you.

import { createHmac, timingSafeEqual } from "node:crypto";

const secret = process.env.MCA_WEBHOOK_SECRET;

// header is the X-MCA-Signature request header.
export function verify(rawBody, header) {
  const expected = "sha256=" + createHmac("sha256", secret).update(rawBody).digest("hex");
  const a = Buffer.from(expected);
  const b = Buffer.from(header ?? "");
  return a.length === b.length && timingSafeEqual(a, b);
}