Authentication

Exchange your API key and secret for a bearer token valid for 10 hours. The POST /getToken operation is the only endpoint that does not require bearer authentication; it uses an HMAC-SHA256 handshake over the request body.

Token lifetime: 10 hours. When a token is about to expire, call getToken again. The response's expiry field is a Unix timestamp.

This token authenticates your publisher account, not an individual end-user — obtain one and reuse it across all of your users' activity. You do not need to call getToken on each end-user visit; only refresh it as it nears expiry. For white-label single sign-on, the per-user login token is a separate concept — see the Users tag.

HMAC signature computation:

code = hash_hmac('sha256', api_key + time_stamp, api_secret) code = hash_hmac('sha256', api_key + time_stamp, api_secret)

The time_stamp must be the current timestamp at the point the signature is computed. Large clock drift (more than a few minutes) will cause signature-mismatch errors.