Stash Documentation
Integration GuidesAPI ReferencePartner with usChangelog

Set user preferences

Creates or updates the payment channel preference for a user. This is a server-side endpoint and should not be called from the client.

POST
/sdk/server/user_preferences/{userId}

Authorization

x-stash-hmac-signature<token>

Versioned HMAC-SHA256 signature authenticating server-to-server SDK requests (your backend calling Stash), as opposed to client-side SDK operations. Recommended over the deprecated X-Stash-Api-Key for the best security. Header format: v1;{appId};{unixMillisTimestamp};{base64Signature} (semicolon-delimited). {base64Signature} is the base64-encoded HMAC-SHA256 of the string {unixMillisTimestamp}.{requestBody} using your app ingress secret (the ingress secret is shown base64-encoded in Studio; base64-decode it to the raw bytes used as the HMAC key), where {requestBody} is the compact canonical request JSON for POST requests and empty for GET requests. The timestamp must be within 5 minutes of Stash server time. Your appId is your immutable app identifier, shown in Stash Studio under Project Settings > App details; your ingress secret is under Project Settings > API Secrets.

In: header

Path Parameters

userIdstring

User ID (external user ID from the game/application). Extracted from URL path.

Request Body

paymentChannelpie.sdk.user_preferences.PaymentChannel

Payment channel preference (STASH_PAY or NATIVE_IAP)

Default"UNSPECIFIED"
Value in"UNSPECIFIED" | "STASH_PAY" | "NATIVE_IAP"

Response Body

curl -X POST "https://test-api.stash.gg/sdk/server/user_preferences/string" \  -H "Content-Type: application/json" \  -d '{    "paymentChannel": "UNSPECIFIED"  }'
{}
{
  "code": 0,
  "message": "string",
  "details": [
    {
      "@type": "string",
      "property1": null,
      "property2": null
    }
  ]
}

How is this guide?

Get user preferences GET

Retrieves the payment channel preference for a specific user. Returns 404 NotFound if no preference is set.

Approve custom login POST

Used to approve custom login requests using JWT authentication (For exampe Apple ID, Google or other JWT based login providers). This is a server-side endpoint and should not be called from the client.