SparkGlim Developer

The right credential for each boundary.

Public reads, Organization signatures and Reseller sessions serve different access models.

Keys and capabilities

Copy the single keyId:secret value issued in Creator settings. Public keys go in x-white-label-key; private keys stay in your backend.

Domains and request origin

Bind the signature to the verified hostname, method, full path, canonical query and exact body bytes. Use a fresh signing nonce on every attempt.

Retries and idempotency

Timestamp tolerance is five minutes. Nonces and idempotency keys use 16–128 letters, digits, underscores or hyphens. A stable business idempotency key does not replace a fresh nonce.

Reseller access

Reseller portal operations use the existing authenticated SparkGlim session and authorized member relationship. Public API routes use their documented access rules, not Organization private-key headers.

Illustrative request with placeholder values

Organization API Version 1

typescript

import { createHash, createHmac, randomBytes } from 'node:crypto'

// Server-side only; this example signs but does not send a request.
const [keyId, secret] = process.env.SPARKGLIM_PRIVATE_KEY.split(':')
const domain = process.env.SPARKGLIM_VERIFIED_DOMAIN
const url = new URL('https://api.sparkglim.net/api/white-label/v1/context')
const timestamp = String(Date.now())
const nonce = randomBytes(16).toString('hex')
const method = 'GET'
const body = ''
const idempotencyKey = '' // Stable operation key for routes that require it.
const campaignKey = '' // Complete optional scoped campaign credential.
const pairs = [...url.searchParams.entries()].sort((a, b) =>
  a[0] === b[0] ? a[1].localeCompare(b[1]) : a[0].localeCompare(b[0]))
const query = pairs.map(([key, value]) =>
  encodeURIComponent(key) + '=' + encodeURIComponent(value)).join('&')
const pathname = url.pathname.replace(/\/$/, '') || '/'
const bodyHash = createHash('sha256').update(body).digest('hex')
const canonical = ['v2', domain, idempotencyKey, campaignKey,
  timestamp, nonce, method, pathname, query, bodyHash].join('.')
const signature = createHmac('sha256', secret).update(canonical).digest('hex')
const headers = {
  'x-white-label-domain': domain,
  'x-white-label-key-id': keyId,
  'x-white-label-signature-version': '2',
  'x-white-label-timestamp': timestamp,
  'x-white-label-nonce': nonce,
  'x-white-label-signature': signature,
}
// For signed POST requests, hash the exact JSON string sent as the body.
// Add X-Idempotency-Key when required and include it in canonical.
// Never expose this private key or generated headers to a public client.

Keys and capabilities

Domains and request origin

Retries and idempotency

Reseller access

Illustrative request with placeholder values

Continue building