Overview

Protocol state and the collateral set your users can borrow against, read live from the sandbox.

Protocol status

Reading from the sandbox.

Checking

Collateral assets

Interest is 0%. The estimated borrow cost is the upside given up when a written call finishes in the money, annualised from historical cycles. It is an estimate, not a charge.

API keys

One key pair per environment. Test keys can never touch live state, which is what makes it safe to leave a sandbox integration running.

Not wired yet. Issuing, revoking and rotating keys needs the API. Until then keys are issued by hand: email builders@spout.finance and we will send one. The screen below is the shape that management will take.

Sandbox secret key

sk_test_••••••••••••••••

Active

Live secret key

Issued when the API goes live and you have signed the partner terms.

Not issued
Treat a secret key like a password. It goes in your server environment, never in client-side code and never in a repository. If one leaks, the fix is to roll it, not to rotate the users behind it.

Request log

Every request this dashboard has made in the current browser session, with the request id you would quote to support.

This session only. A real request log is server side and needs the API. What you see here is the browser's own record, which is enough to show the shape: method, path, status, latency and the id that ties a request to a support conversation.
MethodStatusPathLatencyRequest id

Nothing has gone over the wire yet

The log fills as this dashboard calls the sandbox. Send one from the Sandbox screen and it will appear here with its request id.

Select a row to see the headers sent and the body returned. That pair is what support will ask for.

Webhooks

Where we send events, which events you receive, and how to verify they came from us.

Not wired yet. Registering an endpoint, replaying a delivery and rotating the signing secret all need the API. The event list below is real: it is read from the specification.

Endpoint

Events

Delivery timeline

Attempted
0
Succeeded
0
Retried
0
Given up
0

Empty because nothing delivers yet. It is here now because it is the first thing a partner asks for after their handler misses an event, and designing it late means designing it under pressure.

Delivery is at least once and ordering is not guaranteed. Deduplicate on the event's top-level id, and verify the Spout-Signature header before you trust the body. Your endpoint does not carry a Spout bearer token, so the signature is the authentication.

Sandbox

Send a request without leaving the page. Useful for checking a response shape before you write the code that parses it.

The sandbox validates against the specification, so a request it rejects would have been rejected by the live API. Exercise your error branches here rather than discovering them in production.