Authentication

Bearer API keys

Every protected Web API request sends the complete credential through the standard authorization header.

            Authorization: Bearer ad_live_KEY_ID.SECRET
        

Authenticate through a URL

When a client cannot set headers, pass the credential as access_token. Use HTTPS. URLs may be retained in browser history and web-server, proxy, or analytics logs, so the authorization header remains the safer option.

            https://autodealer.dev/api/service/vin/1HGCM82633A004352/json?access_token=ad_live_KEY_ID.SECRET
        

If both methods are supplied, the Authorization header takes precedence.

Credential anatomy

Storage model

The application generates a high-entropy secret using a cryptographic random-number generator. Only its SHA-256 digest is stored. The original secret cannot be decrypted from the database.

Scopes and lifecycle

Keys receive the explicit vin:read scope. They may be revoked or expired independently of the client account and subscription.

Public demo key

The VIN endpoints accept ad_live_demo.keysecret as the only key that does not require an ApiKeys record. It permits five distinct VINs per client per UTC day. Repeating a VIN already used that day does not consume another demo slot.

            Authorization: Bearer ad_live_demo.keysecret
        

The demo allowance is held in application memory and is not written to ApiKeys, ApiUsageLog, or ApiUsageDaily. All other credentials must be active database-backed keys with the vin:read scope.

Registered-key metering

Every accepted registered-key request creates an ApiUsageLog record and increments its subscription's ApiUsageDaily aggregate. Completion records the HTTP status, duration, and error count.

Authentication responses