Authentication

Authentication can be done in two ways.

API Key

This is the easiest way to authenticate, simply add the x-api-key header with your API Key to your requests.

API Key + JWT Signing

Using JWT adds a degree of complexity but it is strongly recommended to use when you are going to call this API in client-side applications. The JWT Token offers an additional layer of security since it will remain in your source code and will not be sent with requests. You will still need to add the x-api-key to your requests and this time also x-signature. It can be generated as follows:

Go

import (
	"github.com/golang-jwt/jwt/v5"
)

func GenerateSignature(apiKey, jwtKey string) (string, error) {
	claims := jwt.MapClaims{}
	claims["key"] = apiKey
	claims["exp"] = time.Now().Add(time.Second * 15).Unix() // this prevents replay attacks

	token := jwt.NewWithClaims(jwt.SigningMethodHS256, claims)
	tokenString, err := token.SignedString([]byte(jwtKey))
	if err != nil {
		return "", err
	}

	return tokenString, nil
}

JavaScript

Python

Organizations

Organization owners can authenticate API requests on behalf of their users by using their App Key and App Secret. These credentials are available in your organization dashboard.

Add the following headers to your requests:

Header	Description
x-api-key	The user's API Key
x-app-key	Your organization's App Key
x-app-signature	A signed JWT token generated using your App Secret

The signature is generated the same way as the standard JWT signing method:

Go

import (
	"time"
	"github.com/golang-jwt/jwt/v5"
)

func generateSignature(appKey string, appSecret []byte) (string, error) {
	claims := jwt.MapClaims{
		"key": appKey,
		"exp": time.Now().Add(time.Minute).Unix(),
	}
	token := jwt.NewWithClaims(jwt.SigningMethodHS256, claims)
	return token.SignedString(appSecret)
}

JavaScript

Python

The x-app-key and x-app-signature headers are only for organization owners. Individual users should continue using the standard x-api-key authentication.