Environments
In production the API and the consumer SPA share the same origin, so the
webview host equals the API host plus
/consumer.
Clock skew
The HMAC tolerance is ±5 minutes. If your machine drifts (e.g. you missed an NTP sync), you’ll seesignature_expired errors. Sync via NTP or set the
timestamp from a trusted clock source.
Logging
We log every request with areqId. If you hit an unexpected error, send
us the reqId from your client logs (it’s also in our response if you
observe the x-request-id header) and we can pull the full trace.