Coverly Developer Docs

# Sandbox — safe to test, no real data
https://sandbox.coverly-8.polsia.app

# Production
https://coverly-8.polsia.app

<!-- Coverly Quote Widget -->
<script>
  window.coverlyConfig = {
    partner_id: 'your_partner_id',   // Your numeric partner ID (e.g. 42)
    theme: 'dark'                  // 'dark' | 'light'
  };
</script>
<script src="https://coverly-8.polsia.app/embed/coverly.js"></script>

window.addEventListener('message', (event) => {
  const data = JSON.parse(event.data);
  switch (data.type) {
    case 'quote.started':
      console.log('Lead started quote', data.payload);
      break;
    case 'quote.completed':
      console.log('Quote delivered', data.payload);
      break;
    case 'apply.submitted':
      console.log('Application submitted', data.payload);
      break;
  }
});

// quote.started
{
  "type": "quote.started",
  "payload": {
    "leadId": "cl_01J8X...",    // CRM contact ID
    "partnerId": "acme_broker",
    "timestamp": "2026-07-04T10:32:00Z"
  }
}

// quote.completed
{
  "type": "quote.completed",
  "payload": {
    "leadId": "cl_01J8X...",
    "quoteId": "qv_01J9A...",
    "carriers": ["AIG", "Lincoln", "Northwestern", "Pacific Life"],
    "tier": "hot",             // 'hot' | 'warm' | 'cold'
    "aiScore": 92
  }
}

// apply.submitted
{
  "type": "apply.submitted",
  "payload": {
    "leadId": "cl_01J8X...",
    "applicationId": "app_01JB2...",
    "carrier": "AIG"
  }
}

<!-- Coverly Quote Widget (single-script bundle) -->
<script src="https://coverly-8.polsia.app/embed.js?partner=ck_live_<your_key>&primary_color=%23e86b2c&theme=dark"></script>
<div data-coverly-quote></div>

curl -X POST https://coverly-8.polsia.app/api/apply \\
  -H "Content-Type: application/json" \\
  -H "Authorization: Bearer ck_live_a3f9xxxxxxxxxxxxxxxx" \\
  -d '{
    "quoteId": "qv_01J9A3K...",
    "carrier": "AIG",
    "monthlyPrice": 187
  }'

const res = await fetch('https://coverly-8.polsia.app/api/apply', {
  method: 'POST',
  headers: {
    'Content-Type': 'application/json',
    'Authorization': 'Bearer ck_live_a3f9xxxxxxxxxxxxxxxx'
  },
  body: JSON.stringify({
    quoteId: 'qv_01J9A3K...',
    carrier: 'AIG',
    monthlyPrice: 187
  })
});
const data = await res.json();
console.log(data);

{
  "ok": true,
  "applicationId": "app_01JB2...",
  "underwriting": {
    "decision": "approved",       // 'approved' | 'declined' | 'review'
    "score": 87,
    "riskBand": "standard",      // 'preferred' | 'standard' | 'substandard'
    "reason": "Clean MVR, stable income",
    "policyNumber": "CVLY-2026-00942",
    "policyIssued": true,
    "documentType": "pdf"
  }
}

curl -X POST https://coverly-8.polsia.app/api/quote/health \\
  -H "Content-Type: application/json" \\
  -d '{
    "zipCode": "90210",
    "householdSize": 3,
    "memberAges": "42,38,12",
    "householdAgi": 85000,
    "planTierPreference": "silver",
    "name": "Jane Doe",
    "email": "jane@example.com"
  }'

{
  "ok": true,
  "quote": {
    "productLine": "health",
    "aptcMonthly": 350,
    "aptcAnnual": 4200,
    "aiTier": "hot",
    "aiScore": 88,
    "plans": [
      {
        "carrier": "Blue Cross Blue Shield",
        "metal": "silver",
        "monthlyPremiumPre": 485,
        "monthlyPremiumPost": 135,
        "deductible": 3500,
        "moop": 7500,
        "network": "Broad PPO",
        "hsaEligible": false,
        "isBestValue": true
      }
    ]
  }
}

{
  "id": "evt_5f8d3a90-...",
  "type": "policy.issued",
  "created": 1752248712,
  "data": {
    "applicationId": "42",
    "contactId": "318",
    "carrier": "AIG",
    "policyNumber": "CVLY-2026-00942",
    "monthlyPrice": 187
  }
}

const crypto = require('crypto');
const express = require('express');

function verifyCoverlySignature(rawBody, header, secret) {
  const parts = Object.fromEntries(
    header.split(',').map(p => p.split('='))
  );
  const t   = parseInt(parts.t, 10);
  const v1  = parts.v1;

  // 1. Reject stale or far-future timestamps (replay-attack defense).
  const skew = Math.abs(Math.floor(Date.now() / 1000) - t);
  if (!Number.isFinite(t) || skew > 300) return false;

  // 2. Recompute HMAC over `${timestamp}.${rawBody}` and timing-safe compare.
  const expected = crypto
    .createHmac('sha256', secret)
    .update(`${t}.${rawBody}`)
    .digest('hex');

  const a = Buffer.from(v1, 'hex');
  const b = Buffer.from(expected, 'hex');
  return a.length === b.length && crypto.timingSafeEqual(a, b);
}

app.post('/webhooks/coverly',
  express.raw({ type: 'application/json' }),
  (req, res) => {
    const sig = req.headers['coverly-signature'] || '';
    if (!verifyCoverlySignature(req.body, sig, process.env.COVERLY_WEBHOOK_SECRET)) {
      return res.status(401).send('Invalid signature');
    }
    const event = JSON.parse(req.body.toString('utf8'));
    // event.id is stable across retries — use it for idempotency.
    // event.type is one of: lead.created, quote.generated, application.submitted, ...
    // event.data is event-type-specific (see above).
    res.status(200).send('ok');
  });

import hmac, hashlib, time

def verify_coverly_signature(raw_body: bytes, header: str, secret: str) -> bool:
    parts = dict(p.split('=', 1) for p in header.split(','))
    try:
        t = int(parts['t'])
        v1 = parts['v1']
    except (KeyError, ValueError):
        return False

    # 1. Reject timestamps more than 5 minutes off.
    if abs(int(time.time()) - t) > 300:
        return False

    # 2. Recompute HMAC and compare.
    signed = f"{t}.".encode() + raw_body
    expected = hmac.new(secret.encode(), signed, hashlib.sha256).hexdigest()
    return hmac.compare_digest(v1, expected)

# In Flask:
from flask import request, abort

@app.route("/webhooks/coverly", methods=["POST"])
def webhook():
    sig = request.headers.get("Coverly-Signature", "")
    if not verify_coverly_signature(request.get_data(), sig, WEBHOOK_SECRET):
        abort(401)
    event = request.get_json()
    # event["id"] is stable across retries — use it for idempotency.
    return "ok", 200

// POST a new lead
curl -X POST https://coverly-8.polsia.app/api/v1/leads \\
  -H "Authorization: Bearer ck_live_..." \\
  -H "Content-Type: application/json" \\
  -d '{ "email": "...", "zipCode": "...", "vehicle": {...} }'

ck_live_<32-char-key>   // Production key
ck_test_<32-char-key>   // Sandbox key

const crypto = require('crypto');

function signRequest(body, secret) {
  const bodyStr = typeof body === 'string' ? body : JSON.stringify(body);
  const sig = crypto.createHmac('sha256', secret).update(bodyStr).digest('hex');
  return sig;
}

# Example key prefix — shown in the portal
ck_live_a3f9...

# Full key (shown once, never stored)
ck_live_a3f9xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

{
  "email": "you@agency.com"
}

{
  "ok": true,
  "message": "Magic link sent"
}