Build against the CPMCheats API

The CPMCheats API wraps the real CPM, CPM2, Garage and Traffic Racer game integrations behind a signed, rate-limited, observable HTTP surface. Every write is authenticated by an HMAC signature; responses are signed too.

1. Create an API client and key in the owner dashboard.
2. Store the public token, private token and HMAC secret shown once.
3. Sign each request (see below) and call an endpoint under /v1.

Each key has three credentials:

• cpm_pk_live_… — public token, identifies the key (X-API-Key).
• cpm_sk_live_… — private token, authenticates non-signed keys.
• cpm_hmac_live_… — HMAC secret, signs requests and responses. Never sent.

Build the canonical request and HMAC-SHA256 it with your secret:

canonical =
  "v1" \n
  METHOD \n
  PATH \n
  NORMALIZED_QUERY \n
  TIMESTAMP \n
  NONCE \n
  SHA256_HEX(BODY)

signature = HMAC_SHA256(hmac_secret, canonical)

Send these headers:

X-API-Key: cpm_pk_live_…
X-Timestamp: 1790000000
X-Nonce: 550e8400-e29b-41d4-a716-446655440000
X-Signature: <hex>

Query normalization percent-encodes keys/values (encodeURIComponent rules) and sorts by key then value. Timestamps must be within ±300s; nonces are single-use.

Responses carry a signature over the exact bytes returned:

X-Request-ID: …
X-Response-Timestamp: …
X-Response-Nonce: …
X-Response-Signature: HMAC_SHA256(secret,
  "v1" \n REQUEST_ID \n STATUS \n TS \n NONCE \n SHA256(BODY))

All errors use one shape and a typed code:

{ "error": { "code": "INVALID_SIGNATURE",
             "message": "Signature verification failed",
             "request_id": "…" } }

Limits are per key across seconds/minutes/hours/days/months, enforced in Redis so they hold across instances. Responses include X-RateLimit-Limit, X-RateLimit-Remaining, X-RateLimit-Reset; a 429 includes Retry-After.

Important writes accept an Idempotency-Key. The same key with a different payload is rejected; the same key + payload replays the stored result.

Long operations (mass clone, farm, full unlock, bulk car mod, hunt, body-kit/FSO-all) return 202 with a follow-up envelope:

{ "job_id": "…",
  "status": "queued",
  "status_url": "/v1/jobs/{id}",
  "events_url": "/v1/jobs/{id}/events" }

Poll GET /v1/jobs/{id} for the live record, or stream GET /v1/jobs/{id}/events (SSE) for per-step progress — e.g. "Transferring car 12345 (3 of 50)" — until a terminal event. Only the key/client that created a job can read it.

The owner dashboard subscribes to /v1/realtime/ws for live requests, jobs, workers, security events and metrics. The public status page uses /v1/status/events (SSE). Both are push-only — no polling.

Endpoints under /v1/cpm/*: auth, account, money/coins, player, unlocks, rank, friends, cars, store, backup/restore and cloning.

Endpoints under /v1/cpm2/*: auth, money/coins, cars, unlock, buy, king rank, air/siren, FSO, body kits, liveries, daily tasks, farm and create account.

Endpoints under /v1/garage/*: auth, player data, cars, tools and a full hack (player + cars + tools).

Endpoints under /v1/traffic/*: auth, anonymous login and hack (money, gold, level, nitro & turbo).

Register a webhook to receive job.completed, job.failed and job.cancelled with an independent HMAC signature in X-Webhook-Signature.