Authentication¶
The API uses a member API key on a service account. Create the account, organization, service account, and key at e10s.io. Send the key on every request:
Host: https://api.e10s.io. Paths include your organization id from the dashboard.
Member keys belong to one organization. They are not your subscribers’ credentials.
Danger
Keep member API keys on servers only. Never ship them in browsers, mobile apps, or other untrusted clients.
Example¶
POST /api/organizations/{organization_id}/subscribers/{subscriber_id}/entitlements/check
X-API-Key: e10s-mk-1-…
Content-Type: application/json
Rotate keys at e10s.io: create a new key, deploy it, revoke the old one. The plaintext secret is shown once at creation.
What not to send¶
- Do not send tokens for your subscribers’ end users to e10s.
- Authenticate those users in your app, resolve
subscriber_id, then call e10s with your member key.
Failures¶
| HTTP | Meaning |
|---|---|
| 401 | Missing, invalid, or revoked credential |
| 403 | Authenticated but not allowed for this action |
| 404 | Unknown id, or no access to this organization |
e10s does not accept your customers’ logins on this API.