Copy page

Guides

Authentication

Every public API request must include the credentials issued to the calling Platform or Advertiser. Onward uses two headers together:

Both currently published operations use these credentials: read active quest chains and complete account linking.

Header	Required	Purpose
X-API-Key	Yes	Public identifier of the integration credential.
X-API-Secret	Yes	Private secret used to authenticate the request.

Code
GET /v1/quest-chains/active/platform-user-123 HTTP/1.1
Host: api.onwardinc.net
X-API-Key: pk_platform_live_abc123
X-API-Secret: sk_platform_live_xyz789
Accept: application/json

Credential scope

Credentials identify both the integration and its provider type. A Platform credential cannot call Advertiser-only operations, and each credential must have permission for the requested operation.

Authentication and authorization failures use these HTTP statuses:

• 401 Unauthorized — headers are missing or the credential pair is invalid.
• 403 Forbidden — the credential is inactive, has the wrong provider type, or lacks the required permission.

Recommended handling

• Store credentials in a secret manager or protected environment variables.
• Use separate credentials for development and production.
• Rotate credentials periodically and immediately after suspected exposure.
• Do not log X-API-Secret or include it in error reports.
• Use HTTPS for every request.
• Treat repeated 401 and 403 responses as a configuration problem rather than an automatic retry condition.