> ## Documentation Index
> Fetch the complete documentation index at: https://docs.cabalspy.xyz/llms.txt
> Use this file to discover all available pages before exploring further.

# Dashboard settings

> Every CabalSpy ID setting in the API Dashboard, tab by tab: instances, credentials, login button, theses widget, White-Label, competitions, scopes, domains, testers, webhooks and API keys.

You manage CabalSpy ID in the [API Dashboard](https://apidashboard.cabalspy.xyz/csid), on the **CabalSpy ID** tab. One dashboard account and one API key work for the CabalSpy API, the Widget and CabalSpy ID. This page lists every field and button you see there, what it does and where the API reference explains it in detail.

Each app is an **instance**: an OpenID Connect client with its own users, settings and statistics. Open an instance from **Instances** to see its tabs: Overview, Users & stats, Credentials, Login button, Theses, White-label, Competitions, Settings, Domains & testers, Webhooks and Activity.

> [!NOTE]
>
> Where a dashboard label differs from the name in the API, both are given, for example the dashboard's **Where your users' data is visible** is the API setting `data_scope`.

## Start page

The first page of the CabalSpy ID tab sums up all your instances over the last 30 days. It has no settings, only figures and shortcuts.

| Item | Meaning |
| - | - |
| Users, Active 30 days, KOLs, Verified wallets | Your users across all instances: new in 7 days, sign-ins, users with the KOL badge and users with at least one verified wallet. |
| API requests, Rate limited | Data API calls of all your keys and instances, with rate-limited calls and errors. See [Rate limits](https://docs.cabalspy.xyz/cabalspy-id/plans.md#rate-limits). |
| API requests per day, Sign-ins per day | Daily charts for the last 30 days. |
| Instances | Each instance with its users, API requests and mode (LIVE, SANDBOX or DEV). |
| Top endpoints | The Data API endpoints you call most, with rate-limited calls. |
| Theses | Theses, replies, reactions and authors on your instances, and the most discussed tokens. |
| Plan & user limit | Per verified domain: plan, users out of the user limit and request rate. Every domain starts on Free (50 users, 1 request per second). See [Plans and limits](https://docs.cabalspy.xyz/cabalspy-id/plans.md). |
| Users beyond your plan's user limit | A warning with the number of people who signed in above the limit. They can sign in, but you receive no data for them. See [The user limit](https://docs.cabalspy.xyz/cabalspy-id/plans.md#the-user-limit). |
| **Sandbox**, **New instance** | Open the [sandbox](#sandbox) or the [Instances](#instances-page) page. |

## Instances page

Lists your instances with their logo, Instance ID, mode, number of users and domain. The mode is one of **DEVELOPMENT**, **SANDBOX**, **IN REVIEW** or **LIVE**, see [Instance modes](https://docs.cabalspy.xyz/cabalspy-id/overview.md#instance-modes).

**Create an instance** asks for:

| Field | Values | Meaning |
| - | - | - |
| Name | Up to 60 characters, required | Shown on the consent screen. You can change it later in [Settings](#settings). |
| Type | **Server-side web app** (default) or **Single-page or mobile app** | A server-side app is a confidential client: it has a backend and uses a client secret. A single-page or mobile app is a public client: no secret, PKCE only. See [Clients](https://docs.cabalspy.xyz/cabalspy-id/openid-connect.md#clients). The type cannot be changed later in the dashboard. |
| Start in | **Development** (default) or **Sandbox** | Development: real CabalSpy ID accounts, only you and up to 25 [testers](#domains-and-testers) can sign in. Sandbox: made-up test identities only. An instance becomes live with **Go live** on its [Overview](#overview). |
| Redirect URIs | One per line | Where people return after signing in. `http://` only for localhost while developing. You can change them later in [Settings](#settings). |

After creating a server-side app, the dashboard shows its first client secret once, on the [Credentials](#credentials) tab.

## Sandbox

**Sandbox** on the start page lets you call every CabalSpy ID endpoint live with your own API key and copy ready-to-run code. Pick an endpoint, fill in its parameters or JSON body and press **Send request**; **Reset** restores the example values. Only API keys with CabalSpy ID switched on are offered, see [API keys](#api-keys).

The sandbox page is a request tool for the Data API. It is not the same as an instance in sandbox mode.

## Instance tabs

### Overview

| Item | Meaning |
| - | - |
| Get your instance ready | A checklist: add redirect URIs, copy the credentials and sign in once, verify your domain, add logo, website, privacy policy, terms and support e-mail, go live. Sandbox instances only show the first two steps. |
| **Go live** | Switches the instance to live: everyone with a CabalSpy ID can sign in. The button is disabled while something is missing, and the dashboard lists what (**Still missing**). Live instances need a verified domain, a logo, privacy policy and terms URLs and a support e-mail, and every redirect URI and web origin on a verified domain; the checklist also asks for your website. If you request the `wallets` or `onchain` scope, the instance goes to **IN REVIEW** first; a rejected review shows the reviewer's note. |
| Users, Scopes, Domains, Webhook | Connected users, the scopes the instance may request, verified domains and whether a webhook is set. |
| Plan & user limit | The plan of your domain: users out of the limit, users with data and without data, request rate and whether the live stream is included. The plan starts when you verify a domain. **Plan & billing** opens the billing page. See [Plans and limits](https://docs.cabalspy.xyz/cabalspy-id/plans.md). |
| Delete instance | Type the instance name exactly and press **Delete**. This signs everyone out of the app and removes it for good. |

When a live instance reaches 80 percent of its user limit, and again at 100 percent, the instance page shows a banner and you receive an e-mail.

### Users & stats

| Item | Meaning |
| - | - |
| Users, Active 30 days, KOLs, Verified wallets | Users of this instance, new in 7 days, sign-ins, users with the KOL badge, verified wallets and how many users removed access. |
| Sign-ins, last 30 days | Daily sign-ins and first sign-ins. |
| Newest users | The latest users with name, handle, KOL badge and join date. Only people within your plan's user limit are shown by name. |
| **Block** | Blocks the user for this instance. They can no longer sign in to the app, your instance stops seeing them in the Data API, their seat in your plan is freed and you receive a [`consent.revoked`](https://docs.cabalspy.xyz/cabalspy-id/webhooks#events) webhook with `reason: "blocked_by_platform"`. A blocked user who tries to sign in gets `access_denied`, see [OAuth errors](https://docs.cabalspy.xyz/cabalspy-id/openid-connect.md#oauth-errors). |
| Blocked, **Unblock** | The users you blocked, with the date. **Unblock** lets them sign in again. |

### Credentials

| Item | Meaning |
| - | - |
| Client ID (public) | The Instance ID, `csid_...`, your OpenID Connect `client_id`. Use it in widgets on your sites as `data-client-id`. It is not a secret and not your API key. Widgets only load on your instance's allowed origins and verified domain. |
| API key (secret) | A link to the dashboard's [API keys](#api-keys) page. The Data API uses the same key as the CabalSpy API. Keep it on your server. |
| Issuer, Discovery URL | `https://id.cabalspy.xyz` and its discovery document, for your OpenID Connect library. See [Endpoints](https://docs.cabalspy.xyz/cabalspy-id/openid-connect.md#endpoints). |
| Client secrets | Server-side apps only. Each active secret is listed as `csid_sk_...` with its last characters, its creation date and either **active** or the time it expires. |
| **Create secret** / **Roll secret** | Creates a new client secret and shows it once. Copy it to your server right away, only a hash is stored. |
| Current secrets keep working for | Used when you roll: **24 hours** (default), **1 hour**, **7 days** or **0 (stop now)**. The existing secrets stay valid for this long, so you can deploy the new one without downtime. |
| **Revoke** | Ends that secret at once. |
| Data API, Quick start | Copyable examples for the Data API and for Auth.js / NextAuth with your Instance ID and scopes. |

See [Clients](https://docs.cabalspy.xyz/cabalspy-id/openid-connect.md#clients) and [Authentication](https://docs.cabalspy.xyz/cabalspy-id/data-api.md#authentication).

### Login button

The design every embedded login button of this instance uses. `data-*` attributes on an element override single values, see [Attributes](https://docs.cabalspy.xyz/cabalspy-id/login-button.md#attributes). **Save design** stores it; the preview shows the saved design.

| Field | Values | Attribute |
| - | - | - |
| Theme | **Filled** (`dark`) or **Outline (light)** (`light`) | `data-theme` |
| Button colour | Hex colour, `#rrggbb` | `data-color` |
| Text colour | Hex colour, `#rrggbb` | `data-text-color` |
| Shape | **Square**, **Rounded** or **Pill** | `data-shape` |
| Size | **Small**, **Medium** or **Large** (`sm`, `md`, `lg`) | `data-size` |
| Text | Up to 40 characters | `data-label` |
| Show CSID mark | On or off | `data-show-logo` |
| Full width | On or off | `data-full-width` |
| Profile page on your site | Optional URL, up to 300 characters. `{username}` and `{csid_id}` are filled in. | none |

**Profile page on your site** is where **View profile** in the signed-in menu goes, for example `https://yourplatform.xyz/u/{username}`. Left empty, it opens the person's CabalSpy ID profile. **Settings** in the menu always opens CabalSpy ID. See [Signed-in menu](https://docs.cabalspy.xyz/cabalspy-id/login-button.md#signed-in-menu).

The **Embed** box shows the two lines of HTML for your instance: with `data-href` for server-side apps, without it for browser apps.

### Theses

The design and reach of the [thesis widget](https://docs.cabalspy.xyz/cabalspy-id/theses.md) for every embed with this instance's `data-client-id`. `data-*` attributes on an element override single values. **Save design** stores it; the live preview updates as you type but is not saved until you save.

| Field | Values | Attribute |
| - | - | - |
| Which theses are shown | **All platforms** (default) or **Only this instance** | `data-scope` (`global` or `instance`) |
| Theme | **Dark** or **Light** | `data-theme` |
| Font | System, Inter, Mono or Serif | `data-font` |
| Corner radius (px) | 0 to 24 | `data-radius` |
| Default sort | **Newest** (`new`) or **Top** (`top`) | `data-sort` |
| Background, Cards, Text, Secondary text, Borders, Accent, Text on accent, Bullish, Bearish | Hex colours | `data-bg`, `data-card`, `data-text`, `data-muted`, `data-border`, `data-accent`, `data-accent-text`, `data-bull`, `data-bear` |
| Show token header (logo, counts) | On or off | `data-show-header` |
| Show bullish / bearish filter | On or off | `data-show-sentiment` |
| Compact text size | On or off | `data-compact` |

**Reset colours to theme** puts all colours back to the defaults of the chosen theme; changing the theme does the same. **Only this instance** also applies to the Data API and the theses stream when you pass `scope=instance`, see [Reach](https://docs.cabalspy.xyz/cabalspy-id/theses.md#reach).

The tab also shows thesis statistics, the most discussed tokens and the latest theses on this instance. Reports and moderation are handled by CabalSpy. To let people signed in with your login button write theses directly, request the `thesis` scope in [Settings](#settings).

### White-label

Settings for the users your platform manages through the API by your own user id, see [White-Label](https://docs.cabalspy.xyz/cabalspy-id/white-label.md). If the box shows a warning instead, CabalSpy ID could not be reached.

**Platform users** shows how many platform users the instance has, how many took their account into their own CabalSpy ID and the free places for new users. Sandbox and development instances hold up to 25 platform users; live instances count against the plan of their domain, where every user on the domain counts. When no place is left, new users are refused with `plan_user_limit` and existing ones keep working. See [Plan limits](https://docs.cabalspy.xyz/cabalspy-id/white-label.md#plan-limits).

**White-label settings** apply at once when you press **Save settings**. They are the same settings as [GET and POST /v1/platform-users/settings](https://docs.cabalspy.xyz/cabalspy-id/platform-users-settings.md).

| Dashboard | API setting | Values | Effect |
| - | - | - | - |
| Wallets that count | `wallet_trust` | **All wallets** (`all`) or **Verified wallets only** (`verified_only`) | `all`: wallets you import from Privy, Dynamic or any provider count at once for tracking, trades and the leaderboard; payment verification stays available as a badge. `verified_only`: imported wallets are stored but only count once the user verified them with the payment; until then their status is `needs_verification`. |
| Leaderboard | `leaderboard_trust` | **All wallets** (`all`) or **Verified wallets only** (`verified_only`) | Which wallets the [platform leaderboard](https://docs.cabalspy.xyz/cabalspy-id/platform-users-leaderboard.md) ranks. With `all`, each entry says whether the wallet is verified. |
| Where your users' data is visible | `data_scope` | **CabalSpy ID network** (`csid`, default) or **Your platform only** (`platform`) | `csid`: your users are also part of CabalSpy ID: profiles, leaderboard, Trade Feed and theses. `platform`: only your API key sees them, nothing on CabalSpy ID's public pages or on other platforms. |
| No CabalSpy ID branding | `white_label` | On or off | The verify widget, the embedded Theses and Trade Feed widgets and the Telegram trade alerts your users get carry no CabalSpy ID wording or links. While `claim_links` has never been set, it also switches claim links off. |
| Claim links | `claim_links` | On or off | Whether you can create [claim links](https://docs.cabalspy.xyz/cabalspy-id/platform-users-claim.md), so users can take their account into their own CabalSpy ID. Off: the API answers `claim_disabled`. |
| Telegram alerts for your users | `telegram_alerts` | On or off | Trade Feed alerts through the CabalSpy ID Telegram bot for platform users who [linked Telegram](https://docs.cabalspy.xyz/cabalspy-id/platform-users-telegram.md). |

> [!NOTE]
>
> The dashboard always saves all six settings together. After the first save, `claim_links` keeps the value of its checkbox and no longer follows `white_label`.

**Sign-up URL** is the [inbound URL](https://docs.cabalspy.xyz/cabalspy-id/platform-users-inbound.md): your platform or your auth provider (Privy, Dynamic and others) posts its sign-up and wallet events to it, and CabalSpy ID creates or updates the user with their wallets. The URL is the secret, no API key is needed.

| Button | Effect | API |
| - | - | - |
| **Switch on** | Creates the secret URL and shows it once. | [POST /v1/platform-users/inbound/enable](https://docs.cabalspy.xyz/cabalspy-id/platform-users-inbound.md#enable) |
| **Create a new URL** | Replaces the URL. The old one stops working at once. | The same call again |
| **Switch off** | Removes the URL. Events sent to it are no longer accepted. | [POST /v1/platform-users/inbound/disable](https://docs.cabalspy.xyz/cabalspy-id/platform-users-inbound.md#disable) |

While it is on, the box shows **ON** and the time of the last event received.

### Competitions

[Trading competitions](https://docs.cabalspy.xyz/cabalspy-id/competitions.md) between your platform users. The tab lists your competitions with status, metric, participants, end time and rules version (**CHANGED** marks rules that were changed while running). You can run 5 at a time across all your instances, the box shows how many are open.

Open a competition to see its standings (top entries; unranked traders below the minimums show **–**), its rule changes and, while it is scheduled, waiting or running, the forms to change or cancel it.

**New competition** creates one, the same as [POST /v1/competitions](https://docs.cabalspy.xyz/cabalspy-id/competitions-create.md):

| Field | Dashboard default | API field |
| - | - | - |
| Name | Required, up to 100 characters | `name` |
| Chain | Choose from the supported chains | `chain` |
| Ranked by | **Realized PnL (USD)** | `metric`: `pnl_usd` Realized PnL (USD), `pnl` Realized PnL (native), `volume_usd` Volume (USD), `volume` Volume (native), `trades` Number of trades, `win_rate` Win rate |
| Duration (hours) | 168, in steps of 0.5, 1 to 8,760 | `duration_hours` |
| Start (UTC) | Empty: starts when enough participants joined | `starts_at` |
| Min. participants | 2 | `min_participants` |
| Max. participants | Empty: no limit | `max_participants` |
| Min. trades per trader | 1 | `min_trades` |
| Min. volume per trader (USD) | 0 | `min_volume_usd` |
| Wallets | **All wallets** | `wallet_trust`: `all` or `verified_only` |
| Participants | **Users join** | `enrollment`: `opt_in` (you join users with [POST /v1/competitions/join](https://docs.cabalspy.xyz/cabalspy-id/competitions-participants.md)) or `all_users` (every platform user) |
| Joining after the start allowed | On | `late_join` |
| Description | Optional, up to 2,000 characters | `description` |
| Prizes | Optional free text, up to 2,000 characters, returned by the API | `prizes` |

When 5 competitions are open, the form is replaced by a notice. End or cancel one first.

**Change the rules** edits a scheduled, waiting or running competition, the same as [POST /v1/competitions/update](https://docs.cabalspy.xyz/cabalspy-id/competitions-update.md). The form covers name, metric, duration, min. and max. participants, min. trades, min. volume, wallets and late join, plus an optional **Note for the change log** (up to 500 characters). Every change raises the rules version, is listed under **Rule changes** with the time and phase and is sent as the `competition.updated` webhook. Chain, participants mode, start time, description and prizes can only be changed through the API.

**Cancel competition** cancels it for good, the same as [POST /v1/competitions/cancel](https://docs.cabalspy.xyz/cabalspy-id/competitions-update.md#cancel), and sends `competition.ended` with `cancelled: true`.

### Settings

| Box | Field | Meaning |
| - | - | - |
| Branding | Name | Up to 60 characters, required. Shown on the consent screen. |
| Branding | Short description | Up to 200 characters. |
| Branding | Website, Privacy policy, Terms, Support e-mail | Shown on the consent screen. Privacy policy, terms and support e-mail are required to go live, and the go-live checklist also asks for the website. For live apps the links must be on a verified domain. |
| Logo | Upload | Square PNG, JPEG or WebP, at most 1 MB. Required to go live. |
| Redirect URIs and web origins | Redirect URIs | One per line. Must match the `redirect_uri` of your sign-in requests exactly. `http://` only for localhost while developing. Live instances need them on a verified domain. |
| Redirect URIs and web origins | Web origins | One per line. Needed for browser apps that call the token endpoint, for example with the login button. Also where widgets with your client ID may load. Live instances need them on a verified domain. |
| Scopes | Checkboxes | What your app may ask people for. `openid` is always on. Your sign-in requests can only use the scopes checked here, others fail with `invalid_scope`. Scopes marked **REVIEW** (`wallets`, `onchain`) need a short review before they work in live apps. See [Scopes](https://docs.cabalspy.xyz/cabalspy-id/openid-connect.md#scopes). |
| Scopes | Why do you need wallet or on-chain data? | Your reason for the review, for example how you show wallets on your platform. |

Each box has its own save button. Scopes added later show the consent screen again to people who already signed in.

### Domains and testers

The dashboard calls this tab **Domains & testers**.

**Domains** proves that you own your platform's domain. A verified domain is needed to go live and carries your plan: the main domain of your first verified domain (for example `example.com` for `app.example.com`) belongs to your account, and nobody else can add it.

| Item | Meaning |
| - | - |
| **Add domain** | Adds a domain, shown as **NOT VERIFIED** with a token. |
| DNS TXT record or file | Add **one** of them: a TXT record at `_csid-verification.<domain>` or a file at `https://<domain>/.well-known/csid-verification.txt`, containing the token the dashboard shows. |
| **Verify** | Checks the record or file. The domain then shows **VERIFIED**. |
| **Remove** | Removes the domain from the instance. |

**Testers** (not shown for sandbox instances): while an instance is in development, only you and these people can sign in. Add up to 25 by their X handle; they need a CabalSpy ID first. Anyone else gets `access_denied`. **Remove** takes a tester off the list.

### Webhooks

| Item | Meaning |
| - | - |
| Endpoint URL | Where CabalSpy ID sends events with a `POST`, signed with Standard Webhooks (`webhook-id`, `webhook-timestamp`, `webhook-signature`). See [Verify the signature](https://docs.cabalspy.xyz/cabalspy-id/webhooks.md#verify-the-signature). |
| Events | The events to send. Events are only sent for people who granted the matching scope and are within your plan's user limit. See [Events](https://docs.cabalspy.xyz/cabalspy-id/webhooks.md#events). |
| **Save webhook** | Saves URL and events. |
| **Send test event** | Sends a `webhook.test` event to the URL. |
| **Roll signing secret** | Creates a new signing secret (`whsec_...`) and shows it once. The old one stays valid for a while, see [Rolling the secret](https://docs.cabalspy.xyz/cabalspy-id/webhooks.md#rolling-the-secret). |
| **Remove webhook** | Removes the webhook. No more events are sent. |
| Recent deliveries | The latest deliveries with event, status (**DELIVERED**, **FAILED** or pending), attempts, time and last error. See [Delivery and retries](https://docs.cabalspy.xyz/cabalspy-id/webhooks.md#delivery-and-retries). |

### Activity

A log of changes to the instance: when, what, details and the IP address they came from. It has no settings.

## API keys

The **API keys** page of the dashboard is shared by all products. For each key you choose which APIs it may call: the CabalSpy API, CabalSpy ID or both. A key needs at least one. Only keys with CabalSpy ID switched on can call the [Data API](https://docs.cabalspy.xyz/cabalspy-id/data-api.md#authentication), others get `product_not_enabled`, and only they are offered in the [sandbox](#sandbox). Changes reach CabalSpy ID within about 30 seconds.

## Plan and billing

**Plan & billing** opens the CabalSpy ID plans of your domains. Plans are per registrable domain and cover all its live instances, see [Plans and limits](https://docs.cabalspy.xyz/cabalspy-id/plans.md).


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.