Copy page

v1

Authentication

Insights API v1 supports Basic Authentication and Bearer HMAC Authentication. Use the method provisioned for your integration.

Basic Authentication

Send these headers:

Header	Value
Authorization	Basic <Base64(username:password)>
Merchant-Key	Merchant key provided by Privy
Content-Type	application/json

Code
Authorization: Basic <credentials>
Merchant-Key: <merchant-key>
Content-Type: application/json

Bearer HMAC Authentication

Send these headers:

Header	Value
Authorization	Bearer <access-token>
Content-Type	application/json
Timestamp	Request timestamp used to generate the signature
Signature	Base64-encoded client ID and HMAC signature

Build the signature as follows:

1. Remove spaces, line breaks, and backslashes from the JSON request body.
2. Calculate the MD5 digest of the resulting body and encode the digest as Base64.
3. Join Timestamp, client ID, HTTP method, and the Base64 MD5 value with colons: timestamp:client_id:POST:body_md5_base64.
4. Calculate HMAC-SHA256 using the client secret, then encode the result as Base64.
5. Build #client_id:#hmac_base64 and Base64-encode that complete value for the Signature header.

Code
Authorization: Bearer <access-token>
Content-Type: application/json
Timestamp: <timestamp>
Signature: <base64-encoded-signature-envelope>

Keep all credentials and signing secrets on your server. Never expose them in browser or mobile application code.