Using our Secure API Key Endpoints for Billable Content 03 OCT 2023

Developer Guide - using our API Key endpoints for billable content and secure services on our cryptocurrency platform

Emails and Tokens for Authentication

When you successfully register on our platform, we store your emails in an encrypted format. You then use our Faucet to add a small amount of free credit to a member balance and at that point, you are allocated a token per member email. These tokens are GUIDs and are supplied to the Authentication Token end point to retrieve a Bearer Token Header.

Request example using Fiddler

POST https://www.cryptostatto.com/api/AuthenticateToken HTTP/1.1
User-Agent: Fiddler
Host: www.cryptostatto.com
Content-Length: 202
Content-Type: application/json

    {

        "emails" : ["someemail@somewhere.com","someotheremail@elsewhere.com"] ,
    
        "tokens" : ["YOUR TOKEN GUID","YOUR OTHER TOKEN GUID"]
    }


Response example using Fiddler

HTTP/1.1 200 OK Server: Kestrel APIKey: SOMEKEY.OTHERVALUE X-Powered-By: ASP.NET Date: Tue, 03 Oct 2023 16:34:53 GMT Content-Length: 0

We now have the APIKey

We pass that in the header in any future requests to endpoints requiring bearer authentication.

Sample Request to Test endpoint using Fiddler

GET http://www.cryptostatto.com/api/AuthenticateBearerTokenSample HTTP/1.1
User-Agent: Fiddler
Host: www.cryptostatto.com
Content-Length: 0
Content-Type: application/json
APIKey: APIKey: SOMEKEY.OTHERVALUE

Response from sample request from running within Fiddler

HTTP/1.1 200 OK
Transfer-Encoding: chunked
Content-Type: application/json; charset=utf-8
Server: Kestrel
APIKey: 1e86d1c6-1a57-4d93-bdbd-2d5f86703ca6
X-Powered-By: ASP.NET
Date: Tue, 03 Oct 2023 16:41:47 GMT

{"extraInfo":"This is not a genuine API key."}

Access to secured endpoints

We will list the secured endpoints in our Guides and other areas on our site such as the Member Manager. The key takeaway is billable content access will reduce your member balance for each access request. We may secure other endpoints but not charge.

Compromised keys and emails

If, by some catastrophe, all of this information is leaked. You can reset your API Keys within our Member Manager. In exceptional circumstances, we can create a new account. In future, we may add an authenticator such as Google or Microsoft Authenticator capability for multi-factor authentication at the point of authentication.

Conclusion

We have demonstrated posting an authentication request to retrieve a header and then use that APIKey header in a subsequent request to validate the application using the API.

Written with StackEdit.