Authentication

Spike API authenticates end users using HMAC signatures generated with a shared secret key. You can obtain this key from the administrative console.

​

Step 1: Generate an HMAC Signature

Use the secret key from your console to generate an HMAC-SHA256 signature for each user.

​

Code Examples

import hmac
import hashlib

# Example: sign_user("my_application_user_123")
def sign_user(user_id: str) -> str:
    hmac_key = b"HMAC_KEY_FROM_ADMIN_CONSOLE"
    h = hmac.new(hmac_key, user_id.encode(), hashlib.sha256)
    return h.hexdigest()

​

Step 2: Exchange Signature for Access Token

Send the generated signature to the following endpoint to authorize the user and obtain an access token:

https://app-api.spikeapi.com/v3/auth/hmac

​

Request Parameters

​

Example Request

curl --location 'https://app-api.spikeapi.com/v3/auth/hmac' \
    --header 'Content-Type: application/json' \
    --header 'Accept: application/json' \
    --data '{
        "application_id": 9999,
        "application_user_id": "my_application_user_123",
        "signature": "SIGNATURE_FROM_STEP_1"
    }'

​

Response

​

Example Response

{
  "access_token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiI5OTk5Iiwic3ViIjoiYXBwbGljYXRpb24tdXNlci1pZC0xMjMifQ.XnI1y4tkRjdiSeHwUqdmk9em-hTPojtMzbOU30nMd_Y"
}

​

Step 3: Store and Use the Access Token

On successful authentication, the API will return an access token in the response. Store this token securely and include it in the Authorization header for all subsequent API calls:

Authorization: Bearer <access_token>