Exchange API credentials for a bearer token valid for 10 hours.
Header Parameters
Media type the client can parse. Always application/json for this API.
application/jsonBody Parameters
Your publisher API key, supplied during provisioning.
Current timestamp as a YYYY-MM-DD HH:MM:SS string. Must match the timestamp
used to compute code. Clock drift of more than a few minutes will cause failures.
HMAC-SHA256 signature: hash_hmac('sha256', api_key + time_stamp, api_secret).
Response
Token issued. Store token and include it as a bearer header on subsequent calls; expiry is a Unix timestamp.
Response Attributes
Confirmation string. Returns "Login Successful" (typo fixed at source 2026-06-04, PR
Unix timestamp of token issuance.
Unix timestamp of token expiry. Tokens live 10 hours (expiry = created_on + 36000).
JWT (HS256). Send as Authorization: Bearer <token> on subsequent calls.
The request was malformed or missing required parameters. The response body names the specific validation failure (e.g. "UID is required").
Response Attributes
Human-readable failure reason. Safe to surface to integrators but not end-users.
Alternative error message field used by a subset of endpoints (notably getToken
and authentication failures). Integrators should check for both message and
error when parsing failure responses.
Numeric status code echoing the HTTP status (e.g. 400, 401). Populated on
most error paths; a few auth-layer failures omit it.
Authentication failed. Common causes: missing Authorization header, malformed bearer
token, token expired (tokens live 10 hours), or — on getToken itself — HMAC signature
mismatch due to clock drift or wrong secret.
Response Attributes
Human-readable failure reason. Safe to surface to integrators but not end-users.
Alternative error message field used by a subset of endpoints (notably getToken
and authentication failures). Integrators should check for both message and
error when parsing failure responses.
Numeric status code echoing the HTTP status (e.g. 400, 401). Populated on
most error paths; a few auth-layer failures omit it.
Rate limit exceeded. The POST /getToken endpoint is rate-limited to five requests
per minute per source IP; other endpoints may be throttled at the reverse-proxy layer
in response to abusive traffic. Wait and retry with exponential backoff; the
Retry-After header tells you the minimum wait in seconds.
Response Attributes
Human-readable failure reason. Safe to surface to integrators but not end-users.
Alternative error message field used by a subset of endpoints (notably getToken
and authentication failures). Integrators should check for both message and
error when parsing failure responses.
Numeric status code echoing the HTTP status (e.g. 400, 401). Populated on
most error paths; a few auth-layer failures omit it.
Response