Skip to main content

Environments

In production the API and the consumer SPA share the same origin, so the webview host equals the API host plus /consumer.

Clock skew

The HMAC tolerance is ±5 minutes. If your machine drifts (e.g. you missed an NTP sync), you’ll see signature_expired errors. Sync via NTP or set the timestamp from a trusted clock source.

Logging

We log every request with a reqId. If you hit an unexpected error, send us the reqId from your client logs (it’s also in our response if you observe the x-request-id header) and we can pull the full trace.

Where to ask

Changelog