Authenticated endpoints require three HTTP headers:
x-user-api-key
Your API token public key
x-user-api-timestamp
13-digit Unix timestamp in milliseconds
x-user-api-signature
Lowercase hex HMAC-SHA256 signature
Signature Payload
The signature is computed by concatenating the following values with newline characters:
<HTTP_METHOD>
<request path>
<raw query string (without ?)>
<x-user-api-timestamp>
<sha256 hex of raw request body>
Scope Rules
read
GET and HEAD requests only
read_write
GET, POST, PATCH, and DELETE requests
Error Codes
401 UNAUTHORIZED
Invalid or missing credentials
401 INVALID_SIGNATURE
HMAC signature verification failed
401 INVALID_TIMESTAMP
Request timestamp outside 5-minute window
403 INSUFFICIENT_SCOPE
Token lacks required scope for this operation
403 IP_NOT_ALLOWED
Request IP not in token's allowed IPs list
409 USER_ALIAS_REQUIRED
User must create a default alias first
Code Example (JavaScript)
const crypto = require('crypto');
function signRequest(method, path, queryString, body, timestamp, secret) {
const payload = [
method.toUpperCase(),
path,
queryString || '',
timestamp,
crypto.createHash('sha256').update(body || '').digest('hex')
].join('\n');
return crypto.createHmac('sha256', secret)
.update(payload)
.digest('hex');
}
const timestamp = Date.now().toString();
const signature = signRequest('GET', '/v1/me', '', '', timestamp, 'your-secret');