Every request is signed with HMAC-SHA256 using your API secret. You send your key ID, a timestamp, a nonce and the signature in the X-Key-Id, X-Timestamp, X-Nonce and X-Signature headers. Requests older than five minutes are rejected, so a captured request can't be replayed. You can also restrict your keys to a list of IP addresses.
Solutions
For brands
For resellers
For companies
For developers
Industries
Brands
FAQ
Company
Help Centre
Blog
Security
Contact us
Developers and API
How are API requests authenticated?
Was this article helpful?