One secure foundation.
Two isolated environments.

Environments

Production public DNS and HTTPS are pending. Use sandbox for integration until production availability is confirmed. Production access requires explicit approval.

Sandbox keys use xeo_test_<example>. Production keys use xeo_live_<example>. These are placeholders. Credentials, databases, and replay state are isolated; keys cannot cross environments.

Authenticate every request

Send all four headers over HTTPS. Sign on your backend. Never embed a secret in browser code or a mobile app.

Nonce reservations last 600 seconds per credential. Retrying a request requires a fresh timestamp, nonce and signature. Keep your server clock synchronized.

Canonical request

UPPERCASE_HTTP_METHOD
/path?exact=query
timestamp
nonce
sha256(canonical_body)

Join the five fields with a single newline, with no trailing newline. Preserve the exact path and query string sent on the wire. The body hash and signature are hexadecimal. Use the API secret string as the HMAC key; do not Base64-decode it.

For an absent body, hash the empty UTF-8 string. For JSON, recursively sort object keys using JavaScript string ordering, preserve array order, and serialize without extra whitespace using JSON.stringify semantics. Empty object {} and absent body have different hashes. For cross-language JSON, match JavaScript number and string serialization exactly; the downloadable GET samples avoid body serialization differences.

signature = HMAC_SHA256(api_secret, canonical_request).hex()

Do not send an empty body with Content-Type: application/json. Send {} and sign it, or omit the header and body.

Server-side examples

These examples call GET /api/v1/auth/ping. Set XEOTEC_API_KEY and XEOTEC_API_SECRET through your secret manager. Optionally set XEOTEC_BASE_URL.

A successful response has HTTP 200, code: XEO-200, and data.authenticated: true with your authenticated environment.

Errors and limits

Responses include a request ID for support. Authentication failures return 401. Dependency failures return 503. Credential limits allow 60 authenticated requests per 60-second window. A separate runtime limit allows 120 requests per source IP per minute. HTTP 429 indicates throttling; respect Retry-After and retry with a new nonce.

Revoked credentials and suspended partners return the generic invalid-credential error. Explicitly expired credentials may also return that generic error; time-based expiration returns XEO-AUTH-006. Never infer account existence from an error.

Protect your integration

Whitelist your server's public egress IP before calling the API. Missing or nonmatching whitelist entries are rejected. Client-supplied forwarding headers do not grant IP authorization.

Store the one-time API secret immediately in a server-side secret manager. It cannot be retrieved later. Rotation revokes the old key and copies active whitelist entries. Disabling an environment preserves credentials while blocking requests; re-enabling restores otherwise-active credentials. Partner suspension blocks access independently.

Keep secrets out of source control, request logs, analytics, URLs and support tickets. Use HTTPS certificate verification. Rotate exposed credentials immediately. This portal exposes no private administrative operations.