Portal

The portal is a page, on its own domain, where one application's users add and edit endpoints, choose event types, reveal and roll signing secrets, browse every message and delivery attempt, retry deliveries, recover the ones that failed while their server was down, and send test messages. You open it from your product, or embed it in your own settings page.

Open it

Create a portal session from your backend each time a user opens the portal, and send them to its url (never create sessions in the browser: that needs your API key).

const { data: session } = await coss.hooks.portal.createSession({
  application: "customer_8812",
  expires_in: 3600, // seconds; at most a day
});
// Redirect the user to session.url, or embed it.

The URL carries the session's secret token in its fragment (#cossp_…), which browsers never send to a server, so it doesn't end up in logs. The portal keeps it for the tab and removes it from the address bar. Anyone with the URL can use the session until it expires: hand it only to that application's user. Pass read_only: true for a session that can look but not change anything.

Embed it

<iframe src="https://<portal domain>/s/hps_…#cossp_…" style="width: 100%; height: 800px; border: 0"></iframe>

Browsers only show the portal inside an iframe on origins you allow: add your site's origin (for example https://app.example.com) under Hooks → Portal settings in the dashboard. Without any, the portal only opens as its own page. The same settings set the name, accent color and theme it shows.

What changes in the portal

Everything a user does in the portal goes through the same rules as the API: endpoint URLs must be public https:// URLs, filter types must be registered event types, and test sends count against your send quota. Changes appear in your organization's audit log as made by the API key (or member) that opened the portal, labeled Portal · application <uid>.