Read-only developer reference
Authentication
Send the credential in X-API-Key on every request. Do not put it in a query string,
source repository, browser storage or downloadable connection file.
X-API-Key: g318_publicid_secret
Keys are created in Data access. The console defaults to a 90-day lifetime and records where the operator stored the secret.
Rotation
Rotation creates a replacement immediately and defaults the old key to a
seven-day expiry. Both keys authenticate during that grace period. Move a subset of traffic,
watch the old key's request volume, then let it expire after volume has stayed at zero. The
now option is reserved for an exposed credential.
Revocation takes effect within 60 seconds. Requests already in flight complete normally.
Webhook receiver contract
Return any 2xx before doing slow work. Redirects, timeouts, 4xx and 5xx responses are failures. A delivery is attempted immediately, then retried on the schedule below. After attempt 8, it is exhausted. A manual resend is a separate delivery and does not cancel the automatic retry schedule.
| Attempt | Delay | Cumulative |
|---|---|---|
| 1 | Immediate | 0 seconds |
| 2 | 30 seconds | 30 seconds |
| 3 | 60 seconds | 90 seconds |
| 4 | 120 seconds | 210 seconds |
| 5 | 240 seconds | 450 seconds |
| 6 | 480 seconds | 930 seconds |
| 7 | 960 seconds | 1890 seconds |
| 8 | 1920 seconds | 3810 seconds |
Current sender IP: 178.104.164.174. An allowlist is only a network filter;
always verify every value in X-Gen318-Signature against the raw request body and reject
timestamps older than five minutes. During a secret rotation, old and new signatures share that
one comma-separated header for 24 hours.