Restrict Client-Side Reward Sending

curl --request POST \
  --url https://api.zbdpay.com/api/v1/rewards/app/{rewardsAppId}/api-version-blocklist \
  --header 'Authorization: <authorization>' \
  --header 'Content-Type: application/json' \
  --header 'z-client: <z-client>' \
  --data '
{
  "version": 123,
  "apiRoute": "<string>"
}
'

import requests

url = "https://api.zbdpay.com/api/v1/rewards/app/{rewardsAppId}/api-version-blocklist"

payload = {
    "version": 123,
    "apiRoute": "<string>"
}
headers = {
    "z-client": "<z-client>",
    "Authorization": "<authorization>",
    "Content-Type": "application/json"
}

response = requests.post(url, json=payload, headers=headers)

print(response.text)

const options = {
  method: 'POST',
  headers: {
    'z-client': '<z-client>',
    Authorization: '<authorization>',
    'Content-Type': 'application/json'
  },
  body: JSON.stringify({version: 123, apiRoute: '<string>'})
};

fetch('https://api.zbdpay.com/api/v1/rewards/app/{rewardsAppId}/api-version-blocklist', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://api.zbdpay.com/api/v1/rewards/app/{rewardsAppId}/api-version-blocklist",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "POST",
  CURLOPT_POSTFIELDS => json_encode([
    'version' => 123,
    'apiRoute' => '<string>'
  ]),
  CURLOPT_HTTPHEADER => [
    "Authorization: <authorization>",
    "Content-Type: application/json",
    "z-client: <z-client>"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "https://api.zbdpay.com/api/v1/rewards/app/{rewardsAppId}/api-version-blocklist"

	payload := strings.NewReader("{\n  \"version\": 123,\n  \"apiRoute\": \"<string>\"\n}")

	req, _ := http.NewRequest("POST", url, payload)

	req.Header.Add("z-client", "<z-client>")
	req.Header.Add("Authorization", "<authorization>")
	req.Header.Add("Content-Type", "application/json")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

HttpResponse<String> response = Unirest.post("https://api.zbdpay.com/api/v1/rewards/app/{rewardsAppId}/api-version-blocklist")
  .header("z-client", "<z-client>")
  .header("Authorization", "<authorization>")
  .header("Content-Type", "application/json")
  .body("{\n  \"version\": 123,\n  \"apiRoute\": \"<string>\"\n}")
  .asString();

require 'uri'
require 'net/http'

url = URI("https://api.zbdpay.com/api/v1/rewards/app/{rewardsAppId}/api-version-blocklist")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Post.new(url)
request["z-client"] = '<z-client>'
request["Authorization"] = '<authorization>'
request["Content-Type"] = 'application/json'
request.body = "{\n  \"version\": 123,\n  \"apiRoute\": \"<string>\"\n}"

response = http.request(request)
puts response.read_body

{
  "success": true,
  "message": "API version blocklist created successfully.",
  "data": {
    "id": "e2fbc21e-b524-4304-aa55-b20941ede9f6",
    "rewardsAppId": "b28e0306-2c06-4092-8d56-a1623d6b97fb",
    "version": 1,
    "apiRoute": "/earn/limited-achievement/reward",
    "createdAt": "2025-10-29T14:06:50.321Z"
  }
}

POST

api

rewards

app

{rewardsAppId}

api-version-blocklist

Restrict Client-Side Reward Sending

curl --request POST \
  --url https://api.zbdpay.com/api/v1/rewards/app/{rewardsAppId}/api-version-blocklist \
  --header 'Authorization: <authorization>' \
  --header 'Content-Type: application/json' \
  --header 'z-client: <z-client>' \
  --data '
{
  "version": 123,
  "apiRoute": "<string>"
}
'

import requests

url = "https://api.zbdpay.com/api/v1/rewards/app/{rewardsAppId}/api-version-blocklist"

payload = {
    "version": 123,
    "apiRoute": "<string>"
}
headers = {
    "z-client": "<z-client>",
    "Authorization": "<authorization>",
    "Content-Type": "application/json"
}

response = requests.post(url, json=payload, headers=headers)

print(response.text)

const options = {
  method: 'POST',
  headers: {
    'z-client': '<z-client>',
    Authorization: '<authorization>',
    'Content-Type': 'application/json'
  },
  body: JSON.stringify({version: 123, apiRoute: '<string>'})
};

fetch('https://api.zbdpay.com/api/v1/rewards/app/{rewardsAppId}/api-version-blocklist', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://api.zbdpay.com/api/v1/rewards/app/{rewardsAppId}/api-version-blocklist",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "POST",
  CURLOPT_POSTFIELDS => json_encode([
    'version' => 123,
    'apiRoute' => '<string>'
  ]),
  CURLOPT_HTTPHEADER => [
    "Authorization: <authorization>",
    "Content-Type: application/json",
    "z-client: <z-client>"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "https://api.zbdpay.com/api/v1/rewards/app/{rewardsAppId}/api-version-blocklist"

	payload := strings.NewReader("{\n  \"version\": 123,\n  \"apiRoute\": \"<string>\"\n}")

	req, _ := http.NewRequest("POST", url, payload)

	req.Header.Add("z-client", "<z-client>")
	req.Header.Add("Authorization", "<authorization>")
	req.Header.Add("Content-Type", "application/json")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

HttpResponse<String> response = Unirest.post("https://api.zbdpay.com/api/v1/rewards/app/{rewardsAppId}/api-version-blocklist")
  .header("z-client", "<z-client>")
  .header("Authorization", "<authorization>")
  .header("Content-Type", "application/json")
  .body("{\n  \"version\": 123,\n  \"apiRoute\": \"<string>\"\n}")
  .asString();

require 'uri'
require 'net/http'

url = URI("https://api.zbdpay.com/api/v1/rewards/app/{rewardsAppId}/api-version-blocklist")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Post.new(url)
request["z-client"] = '<z-client>'
request["Authorization"] = '<authorization>'
request["Content-Type"] = 'application/json'
request.body = "{\n  \"version\": 123,\n  \"apiRoute\": \"<string>\"\n}"

response = http.request(request)
puts response.read_body

{
  "success": true,
  "message": "API version blocklist created successfully.",
  "data": {
    "id": "e2fbc21e-b524-4304-aa55-b20941ede9f6",
    "rewardsAppId": "b28e0306-2c06-4092-8d56-a1623d6b97fb",
    "version": 1,
    "apiRoute": "/earn/limited-achievement/reward",
    "createdAt": "2025-10-29T14:06:50.321Z"
  }
}

Block client-side SendReward calls by adding an API version blocklist entry to your Rewards App.

This step is optional but highly recommended for apps with high-value rewards or when you need complete control over reward issuance.

Enabling the blocklist rejects client SDK reward calls for this app. You can revert at any time by deleting the blocklist entry.

Configuration

Header Parameters

string

required

Client identifier (use “developer-dashboard” )

string

required

Bearer token for authenticationFormat: Bearer {JWT_TOKEN}

Path Parameters

string

required

Your Rewards App ID

Body Parameters

number

required

API version to blocklistUse 1 to block client SDK calls (to block Send Reward v1)

string

required

The API route to blocklistUse “/earn/limited-achievement/reward” to block client reward sending

{
  "success": true,
  "message": "API version blocklist created successfully.",
  "data": {
    "id": "e2fbc21e-b524-4304-aa55-b20941ede9f6",
    "rewardsAppId": "b28e0306-2c06-4092-8d56-a1623d6b97fb",
    "version": 1,
    "apiRoute": "/earn/limited-achievement/reward",
    "createdAt": "2025-10-29T14:06:50.321Z"
  }
}

{
  "success": false,
  "message": "Invalid parameters"
}

{
  "success": false,
  "message": "Authentication required"
}

{
  "success": false,
  "message": "Developer does not own this app"
}

{
  "success": false,
  "message": "Blocklist entry already exists"
}

{
  "success": false,
  "message": "Internal server error"
}

Response Fields

Field	Type	Description
`success`	boolean	Whether the request was successful
`message`	string	Description of the result
`data`	object	Contains blocklist entry details
`id`	string	Unique identifier for this blocklist entry
`rewardsAppId`	string	Your Rewards App ID
`version`	number	API version that is blocklisted (Send Reward v1)
`apiRoute`	string	The API route that is blocklisted
`createdAt`	string	ISO 8601 timestamp of when the entry was created

Response Status Codes

Code	Description
`200`	Blocklist entry created successfully
`400`	Bad request - invalid parameters
`401`	Unauthorized - authentication required
`403`	Forbidden - developer does not own this app
`409`	Conflict - blocklist entry already exists
`500`	Internal server error

What Happens After Restriction?

After applying this blocklist:

Client SDK Blocked

Client SDK calls to send rewards will be rejected

Backend Server Active

Server calls with API key will continue to work

Client SDK Behavior

When a client tries to send rewards via v1 after the blocklist is applied:

Error: This endpoint requires API key authentication. Please use the API key endpoint instead.

Server Behavior

Your backend server can continue sending rewards normally using the v2 endpoint with your API key.

Code Examples

const rewardsAppId = 'YOUR_REWARDS_APP_ID';
const jwtToken = 'YOUR_JWT_TOKEN';

async function restrictClientRewards(rewardsAppId) {
  const response = await fetch(
    `https://api.zbdpay.com/api/v1/rewards/app/${rewardsAppId}/api-version-blocklist`,
    {
      method: 'POST',
      headers: {
        'z-client': 'developer-dashboard',
        'Authorization': `Bearer ${jwtToken}`
      },
      body: JSON.stringify({
        version: 1,
        apiRoute: '/earn/limited-achievement/reward'
      })
    }
  );

  const data = await response.json();

  if (data.success) {
    console.log('Client rewards restricted successfully!');
    console.log(`Blocklist entry ID: ${data.data.id}`);
    return data.data;
  } else {
    throw new Error(`Failed: ${data.message}`);
  }
}

// Apply restriction
await restrictClientRewards('b28e0306-2c06-4092-8d56-a1623d6b97fb');

curl --location 'https://api.zbdpay.com/api/v1/rewards/app/{rewardsAppId}/api-version-blocklist' \
--header 'z-client: developer-dashboard' \
--header 'Authorization: Bearer {JWT_TOKEN}' \
--data '{
  "version": 1,
  "apiRoute": "/earn/limited-achievement/reward"
}'

import requests
import os

jwt_token = os.getenv('JWT_TOKEN')
rewards_app_id = "YOUR_REWARDS_APP_ID"

def restrict_client_rewards(rewards_app_id):
    """Disable client-side reward sending"""

    url = f"https://api.zbdpay.com/api/v1/rewards/app/{rewards_app_id}/api-version-blocklist"
    headers = {
        "z-client": "developer-dashboard",
        "Authorization": f"Bearer {jwt_token}"
    }
    payload = {
        "version": 1,
        "apiRoute": "/earn/limited-achievement/reward"
    }

    response = requests.post(url, json=payload, headers=headers)
    data = response.json()

    if data["success"]:
        print("Client rewards restricted successfully!")
        print(f"Blocklist entry ID: {data['data']['id']}")
        return data["data"]
    else:
        raise Exception(f"Failed: {data['message']}")

# Apply restriction
restrict_client_rewards("b28e0306-2c06-4092-8d56-a1623d6b97fb")

You only need to create a single block list entry with version 1 to disable client-side rewards. To re-enable client rewards, simply delete that block list entry. You can remove the blocklist entry at any time to re-enable client-side reward sending by deleting the blocklist entry.

What’s Next?

You’ve now restricted client-side reward sending and enforced backend-only control. Next, manage and secure your Rewards App:

Manage via Dashboard — Create, list, and revoke API keys for your Rewards App.

Manage via Dashboard Revenue-Based Earning

⌘I

Overview

Concepts

Setup

Sending Rewards

Balances & Limits

Go Live

App Stores

Restrict Client-Side Reward Sending

Configuration

Header Parameters

Path Parameters

Body Parameters

Response Fields

Response Status Codes

What Happens After Restriction?

Client SDK Blocked

Backend Server Active

Client SDK Behavior

Server Behavior

Code Examples

What’s Next?

​Configuration

​Header Parameters

​Path Parameters

​Body Parameters

​Response Fields

​Response Status Codes

​What Happens After Restriction?

Client SDK Blocked

Backend Server Active

​Client SDK Behavior

​Server Behavior

​Code Examples

​What’s Next?

Configuration

Header Parameters

Path Parameters

Body Parameters

Response Fields

Response Status Codes

What Happens After Restriction?

Client SDK Behavior

Server Behavior

Code Examples

What’s Next?