Authentication and API keys

Pixalate’s REST APIs authenticate each request with an API key. You send the key in the x-api-key HTTP header. There are no sessions or tokens to manage.

Send your key in the x-api-key header

Add the header to every request:

curl "https://api.pixalate.com/api/v2/mrt/apps?pretty=true" \
  -H "x-api-key: $PIXALATE_API_KEY"

That example calls the Enrichment API’s metadata endpoint, which returns your quota status without using any quota. It’s a good way to check that your key works.

The header is the same for the Fraud API, Enrichment API, Analytics Reports API, SCO Validation & Verification API and OpenEPG Enrichment API (preview).

If the key is missing or wrong, the API returns 401 Unauthorized. See Quotas, limits and errors for the other status codes.

Get an API key

How you get a key depends on the API.

Self-serve sign-up

Through your account manager

If you have a contract with Pixalate, or you need the Analytics Reports API or the OpenEPG preview, contact your Pixalate account manager. If you used a username and password with an older Pixalate API, see Migrating from legacy APIs.

Keep your key safe

Your API key identifies your account. Anyone who has it can use your account’s access and quota.

• Call the APIs from your servers. Don’t put the key in a mobile app, a CTV app, browser JavaScript or any other code you ship to users. Anything you ship can be extracted.
• Send the key only in the header. Never put it in a URL or query string. URLs end up in logs, browser history and analytics tools.
• Keep it out of source control. Load it from an environment variable or a secrets manager rather than hard-coding it.
• Limit who can see it. Share it only with the people and systems that need it.
• Act quickly if it leaks. If you think someone else has your key, contact support@pixalate.com or your Pixalate account manager.

Related