Authentication

DidYouGo provides multiple authentication methods depending on the integration type. Choose the one that fits your use case.

API Key + Secret (Recommended for Integrations)

For server-to-server integrations. Pass your API key and secret as a Bearer token separated by a colon.

Headers

Example

curl -H "Authorization: Bearer pk_live_abc123:sk_live_xyz789" \
  http://staging.didyougo.com.au/api/qrcodes

import requests

api_key = "pk_live_abc123"
api_secret = "sk_live_xyz789"
auth = f"Bearer {api_key}:{api_secret}"

response = requests.get(
    "http://staging.didyougo.com.au/api/qrcodes",
    headers={"Authorization": auth}
)
print(response.json())

Optional: Scope to an Organization

HMAC Signature (Service Confirmations)

Used exclusively for service confirmation check-in. Sign the request body with your shared secret.

Error Responses

Common error handling and throttling behaviour are covered in Errors & Rate Limits.

Authentication is versioned alongside the rest of the API — the default is v1. See Errors & Rate Limits for details on API versioning.

Role-Based Access