Restrict Client-Side Reward Sending
curl --request POST \
--url https://api.zbdpay.com/api/v1/rewards/app/{rewardsAppId}/api-version-blocklist \
--header 'Authorization: <authorization>' \
--header 'Content-Type: application/json' \
--header 'z-client: <z-client>' \
--data '
{
"version": 123,
"apiRoute": "<string>"
}
'import requests
url = "https://api.zbdpay.com/api/v1/rewards/app/{rewardsAppId}/api-version-blocklist"
payload = {
"version": 123,
"apiRoute": "<string>"
}
headers = {
"z-client": "<z-client>",
"Authorization": "<authorization>",
"Content-Type": "application/json"
}
response = requests.post(url, json=payload, headers=headers)
print(response.text)const options = {
method: 'POST',
headers: {
'z-client': '<z-client>',
Authorization: '<authorization>',
'Content-Type': 'application/json'
},
body: JSON.stringify({version: 123, apiRoute: '<string>'})
};
fetch('https://api.zbdpay.com/api/v1/rewards/app/{rewardsAppId}/api-version-blocklist', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api.zbdpay.com/api/v1/rewards/app/{rewardsAppId}/api-version-blocklist",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_POSTFIELDS => json_encode([
'version' => 123,
'apiRoute' => '<string>'
]),
CURLOPT_HTTPHEADER => [
"Authorization: <authorization>",
"Content-Type: application/json",
"z-client: <z-client>"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://api.zbdpay.com/api/v1/rewards/app/{rewardsAppId}/api-version-blocklist"
payload := strings.NewReader("{\n \"version\": 123,\n \"apiRoute\": \"<string>\"\n}")
req, _ := http.NewRequest("POST", url, payload)
req.Header.Add("z-client", "<z-client>")
req.Header.Add("Authorization", "<authorization>")
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.post("https://api.zbdpay.com/api/v1/rewards/app/{rewardsAppId}/api-version-blocklist")
.header("z-client", "<z-client>")
.header("Authorization", "<authorization>")
.header("Content-Type", "application/json")
.body("{\n \"version\": 123,\n \"apiRoute\": \"<string>\"\n}")
.asString();require 'uri'
require 'net/http'
url = URI("https://api.zbdpay.com/api/v1/rewards/app/{rewardsAppId}/api-version-blocklist")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Post.new(url)
request["z-client"] = '<z-client>'
request["Authorization"] = '<authorization>'
request["Content-Type"] = 'application/json'
request.body = "{\n \"version\": 123,\n \"apiRoute\": \"<string>\"\n}"
response = http.request(request)
puts response.read_body{
"success": true,
"message": "API version blocklist created successfully.",
"data": {
"id": "e2fbc21e-b524-4304-aa55-b20941ede9f6",
"rewardsAppId": "b28e0306-2c06-4092-8d56-a1623d6b97fb",
"version": 1,
"apiRoute": "/earn/limited-achievement/reward",
"createdAt": "2025-10-29T14:06:50.321Z"
}
}
Send Rewards (Server)
Restrict Client-Side Reward Sending
Disable client-side SendReward calls by adding an API version blocklist entry to enforce server-only rewards.
POST
/
api
/
v1
/
rewards
/
app
/
{rewardsAppId}
/
api-version-blocklist
Restrict Client-Side Reward Sending
curl --request POST \
--url https://api.zbdpay.com/api/v1/rewards/app/{rewardsAppId}/api-version-blocklist \
--header 'Authorization: <authorization>' \
--header 'Content-Type: application/json' \
--header 'z-client: <z-client>' \
--data '
{
"version": 123,
"apiRoute": "<string>"
}
'import requests
url = "https://api.zbdpay.com/api/v1/rewards/app/{rewardsAppId}/api-version-blocklist"
payload = {
"version": 123,
"apiRoute": "<string>"
}
headers = {
"z-client": "<z-client>",
"Authorization": "<authorization>",
"Content-Type": "application/json"
}
response = requests.post(url, json=payload, headers=headers)
print(response.text)const options = {
method: 'POST',
headers: {
'z-client': '<z-client>',
Authorization: '<authorization>',
'Content-Type': 'application/json'
},
body: JSON.stringify({version: 123, apiRoute: '<string>'})
};
fetch('https://api.zbdpay.com/api/v1/rewards/app/{rewardsAppId}/api-version-blocklist', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api.zbdpay.com/api/v1/rewards/app/{rewardsAppId}/api-version-blocklist",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_POSTFIELDS => json_encode([
'version' => 123,
'apiRoute' => '<string>'
]),
CURLOPT_HTTPHEADER => [
"Authorization: <authorization>",
"Content-Type: application/json",
"z-client: <z-client>"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://api.zbdpay.com/api/v1/rewards/app/{rewardsAppId}/api-version-blocklist"
payload := strings.NewReader("{\n \"version\": 123,\n \"apiRoute\": \"<string>\"\n}")
req, _ := http.NewRequest("POST", url, payload)
req.Header.Add("z-client", "<z-client>")
req.Header.Add("Authorization", "<authorization>")
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.post("https://api.zbdpay.com/api/v1/rewards/app/{rewardsAppId}/api-version-blocklist")
.header("z-client", "<z-client>")
.header("Authorization", "<authorization>")
.header("Content-Type", "application/json")
.body("{\n \"version\": 123,\n \"apiRoute\": \"<string>\"\n}")
.asString();require 'uri'
require 'net/http'
url = URI("https://api.zbdpay.com/api/v1/rewards/app/{rewardsAppId}/api-version-blocklist")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Post.new(url)
request["z-client"] = '<z-client>'
request["Authorization"] = '<authorization>'
request["Content-Type"] = 'application/json'
request.body = "{\n \"version\": 123,\n \"apiRoute\": \"<string>\"\n}"
response = http.request(request)
puts response.read_body{
"success": true,
"message": "API version blocklist created successfully.",
"data": {
"id": "e2fbc21e-b524-4304-aa55-b20941ede9f6",
"rewardsAppId": "b28e0306-2c06-4092-8d56-a1623d6b97fb",
"version": 1,
"apiRoute": "/earn/limited-achievement/reward",
"createdAt": "2025-10-29T14:06:50.321Z"
}
}
Block client-side
SendReward calls by adding an API version blocklist entry to your Rewards App.
This step is optional but highly recommended for apps with high-value rewards or when you need complete control over reward issuance.
Enabling the blocklist rejects client SDK reward calls for this app. You can revert at any time by deleting the blocklist entry.
Configuration
Header Parameters
string
required
Client identifier (use
“developer-dashboard” )string
required
Bearer token for authenticationFormat:
Bearer {JWT_TOKEN}Path Parameters
string
required
Your Rewards App ID
Body Parameters
number
required
API version to blocklistUse
1 to block client SDK calls (to block Send Reward v1)string
required
The API route to blocklistUse
“/earn/limited-achievement/reward” to block client reward sending{
"success": true,
"message": "API version blocklist created successfully.",
"data": {
"id": "e2fbc21e-b524-4304-aa55-b20941ede9f6",
"rewardsAppId": "b28e0306-2c06-4092-8d56-a1623d6b97fb",
"version": 1,
"apiRoute": "/earn/limited-achievement/reward",
"createdAt": "2025-10-29T14:06:50.321Z"
}
}
{
"success": false,
"message": "Invalid parameters"
}
{
"success": false,
"message": "Authentication required"
}
{
"success": false,
"message": "Developer does not own this app"
}
{
"success": false,
"message": "Blocklist entry already exists"
}
{
"success": false,
"message": "Internal server error"
}
Response Fields
| Field | Type | Description |
|---|---|---|
success | boolean | Whether the request was successful |
message | string | Description of the result |
data | object | Contains blocklist entry details |
id | string | Unique identifier for this blocklist entry |
rewardsAppId | string | Your Rewards App ID |
version | number | API version that is blocklisted (Send Reward v1) |
apiRoute | string | The API route that is blocklisted |
createdAt | string | ISO 8601 timestamp of when the entry was created |
Response Status Codes
| Code | Description |
|---|---|
200 | Blocklist entry created successfully |
400 | Bad request - invalid parameters |
401 | Unauthorized - authentication required |
403 | Forbidden - developer does not own this app |
409 | Conflict - blocklist entry already exists |
500 | Internal server error |
What Happens After Restriction?
After applying this blocklist:Client SDK Blocked
Client SDK calls to send rewards will be rejected
Backend Server Active
Server calls with API key will continue to work
Client SDK Behavior
When a client tries to send rewards via v1 after the blocklist is applied:Error: This endpoint requires API key authentication. Please use the API key endpoint instead.
Server Behavior
Your backend server can continue sending rewards normally using the v2 endpoint with your API key.Code Examples
const rewardsAppId = 'YOUR_REWARDS_APP_ID';
const jwtToken = 'YOUR_JWT_TOKEN';
async function restrictClientRewards(rewardsAppId) {
const response = await fetch(
`https://api.zbdpay.com/api/v1/rewards/app/${rewardsAppId}/api-version-blocklist`,
{
method: 'POST',
headers: {
'z-client': 'developer-dashboard',
'Authorization': `Bearer ${jwtToken}`
},
body: JSON.stringify({
version: 1,
apiRoute: '/earn/limited-achievement/reward'
})
}
);
const data = await response.json();
if (data.success) {
console.log('Client rewards restricted successfully!');
console.log(`Blocklist entry ID: ${data.data.id}`);
return data.data;
} else {
throw new Error(`Failed: ${data.message}`);
}
}
// Apply restriction
await restrictClientRewards('b28e0306-2c06-4092-8d56-a1623d6b97fb');
curl --location 'https://api.zbdpay.com/api/v1/rewards/app/{rewardsAppId}/api-version-blocklist' \
--header 'z-client: developer-dashboard' \
--header 'Authorization: Bearer {JWT_TOKEN}' \
--data '{
"version": 1,
"apiRoute": "/earn/limited-achievement/reward"
}'
import requests
import os
jwt_token = os.getenv('JWT_TOKEN')
rewards_app_id = "YOUR_REWARDS_APP_ID"
def restrict_client_rewards(rewards_app_id):
"""Disable client-side reward sending"""
url = f"https://api.zbdpay.com/api/v1/rewards/app/{rewards_app_id}/api-version-blocklist"
headers = {
"z-client": "developer-dashboard",
"Authorization": f"Bearer {jwt_token}"
}
payload = {
"version": 1,
"apiRoute": "/earn/limited-achievement/reward"
}
response = requests.post(url, json=payload, headers=headers)
data = response.json()
if data["success"]:
print("Client rewards restricted successfully!")
print(f"Blocklist entry ID: {data['data']['id']}")
return data["data"]
else:
raise Exception(f"Failed: {data['message']}")
# Apply restriction
restrict_client_rewards("b28e0306-2c06-4092-8d56-a1623d6b97fb")
You only need to create a single block list entry with version 1 to disable client-side rewards. To re-enable client rewards, simply delete that block list entry.
You can remove the blocklist entry at any time to re-enable client-side reward sending by deleting the blocklist entry.
What’s Next?
You’ve now restricted client-side reward sending and enforced backend-only control. Next, manage and secure your Rewards App:- Manage via Dashboard — Create, list, and revoke API keys for your Rewards App.
Was this page helpful?