Authentication

This section provides documentation on the v1.0 version of the Mashery API.  We will support previously built applications and integration points, but not granting new access keys.  These pages are for legacy support purposes.  Should you wish to integrate with your Mashery instance, please utilize Mashery API version 2.0.

The initial release of the Mashery API requires a known token to be passed as part of the request query string. The token is called apikey. The value of the token is a 24 character alphanumeric string assigned by Mashery.

The apikey passed in the request must match a Mashery client area name. The apikey and mashery_area are used to retrieve permissions which determine if the requesting user is allowed to use the method passed in the API request.

Finally, each request must be signed. Valid signature is determined by examining a sig parameter from the query string of the request. The sig value is calculated by generating an MD5 hash made up of the API key, the API user's shared secret, and a UNIX timestamp reflecting number of seconds since the Unix Epoch (January 1 1970 00:00:00 GMT) at the time the request was made. A five-minute wiggle is permitted on either side of the current timestamp on the Mashery server to allow for reasonable clock drift.

Most programming languages provide an md5()-type of function. The signature should be generating using such a function.

The following is an example of generating a valid signature with PHP:

<?php
$apikey = '2fvmer3qbk7f3jnqneg58bu2';
$secret = 'qvxkmw57pec7';
$timestamp = time(); // 1200603038

$sig = md5($apikey . $secret . $timestamp);
?>

An example request to the JSON-RPC interface to the Mashery API, based on a timestamp of 1200603038 (Thu, 17 Jan 2008 20:50:38 +0000), an apikey of 2fvmer3qbk7f3jnqneg58bu2 and a secret of qvxkmw57pec7:

http://api.mashery.com/services/jsonrpc?apikey=2fvmer3qbk7f3jnqneg58bu2&sig=65a08176826fa4621116997e1dd775fa&mashery_area=example