Authentication

Every API call is authenticated with three HTTP headers. Your SecretKey is never transmitted - it is only used to derive the token.

Parameter	Located in	Description
`ApiKey`	HTTP header	Identifies your API account. If it is ever exposed, contact support immediately so we can rotate it for you.
`Timespan`	HTTP header	Unix timestamp, second precision.
`Token`	HTTP header	32-character uppercase MD5 hash of `ApiKey + Timespan + SecretKey`.
`SecretKey`	Do not transmit	Keep it secure. Open the avatar menu and choose My account - Credentials & access.

Token generation

import hashlib, time, requests

API_KEY    = "YOUR_API_KEY"
SECRET_KEY = "YOUR_SECRET_KEY"

timespan = str(int(time.time()))
token = hashlib.md5((API_KEY + timespan + SECRET_KEY).encode()).hexdigest().upper()

headers = {
    "ApiKey":   API_KEY,
    "Timespan": timespan,
    "Token":    token,           # 32-char UPPERCASE MD5
    "Content-Type": "application/json",
}
resp = requests.get(BASE_URL + ENDPOINT, params=params, headers=headers)
data = resp.json()               # check data["status"], not just HTTP 200

const crypto = require("crypto");

const API_KEY    = "YOUR_API_KEY";
const SECRET_KEY = "YOUR_SECRET_KEY";

const timespan = Math.floor(Date.now() / 1000).toString();
const token = crypto.createHash("md5")
  .update(API_KEY + timespan + SECRET_KEY)
  .digest("hex").toUpperCase();          // 32-char UPPERCASE MD5

const res = await fetch(BASE_URL + ENDPOINT + "?" + new URLSearchParams(params), {
  headers: { ApiKey: API_KEY, Timespan: timespan, Token: token,
             "Content-Type": "application/json" }
});
const data = await res.json();           // check data.status, not just HTTP 200

import java.security.MessageDigest;

String apiKey    = "YOUR_API_KEY";
String secretKey = "YOUR_SECRET_KEY";
String timespan  = String.valueOf(System.currentTimeMillis() / 1000L);

MessageDigest md = MessageDigest.getInstance("MD5");
byte[] digest = md.digest((apiKey + timespan + secretKey).getBytes("UTF-8"));
StringBuilder sb = new StringBuilder();
for (byte b : digest) sb.append(String.format("%02X", b));  // UPPERCASE
String token = sb.toString();

HttpRequest req = HttpRequest.newBuilder(URI.create(baseUrl + endpoint))
    .header("ApiKey", apiKey)
    .header("Timespan", timespan)
    .header("Token", token)
    .header("Content-Type", "application/json")
    .GET().build();
// parse the body and check the "status" field, not just HTTP 200

The two classic mistakes behind error 115: a lowercase token (it must be uppercase MD5) and server clock drift (the Timespan is valid for 300 seconds).