Environments
In staging and production the API and the consumer SPA share the same origin,
so the webview host equals the API host plus
/consumer.
Staging characteristics. Staging sleeps when idle — the first request
after a quiet period can take up to a minute to respond while the instance
wakes. Retry rather than treating it as an outage. Staging also tracks our
integration branch, so it may run ahead of production, and its data is not
production data (it can be reset without notice). Build against staging,
verify against production.
Clock skew
The HMAC tolerance is ±5 minutes. If your machine drifts (e.g. you missed an NTP sync), you’ll seesignature_expired errors. Sync via NTP or set the
timestamp from a trusted clock source.
Logging
We log every request with areqId. If you hit an unexpected error, send
us the reqId from your client logs (it’s also in our response if you
observe the x-request-id header) and we can pull the full trace.