2nd Jan 2019

API Authentication

Integration API requests must authenticate themselves by generating an HMAC signature for each request and adding a Content-Signature header. The secret key for generating the HMAC signature can be retrieved in the Developer Settings of the Campaign Manager, or via the getApplication operation of the Management API.

Example signature generation (PHP)

The code below demonstrates how to generate the signature for a request in PHP, assuming $json_string is the JSON encoded payload of the request, $application_id is the ID of the application sending the request, and $application_key is the secret key from your application (e.g. "fefecafedeadbeef").

$key = hex2bin($application_key);
$signature = hash_hmac('md5', $json_string, $key);

curl_setopt($ch, CURLOPT_HTTPHEADER, array(
    'Content-Type: application/json',
    'Content-Signature: signer='.
    $application_id .'; signature='.$signature

Example signature generation (Node.js)

Here is the same example for Node.js, assuming jsonString, applicationId, and applicationKey have been defined.

var crypto = require('crypto')
var hmac = crypto.createHmac('md5', new Buffer(applicationKey, 'hex'));
var signature = hmac.read().toString('hex')
req.setHeader('Content-Signature', 'signer=' + applicationId + '; signature=' + signature)
Still need help? Get in touch!
Last updated on 2nd Jan 2019

Was this article helpful?

Thank you! You have already voted

If you’d like a member of our support team to respond to you, please send a note to support@talon.one