Bidyard Logo
DashboardSign In

Authentication Guide

Learn how to authenticate with the BidYard API

Overview

BidYard uses different authentication methods depending on which API endpoint you're accessing:

  • Lead Delivery API (POST /v1/leads): Source Token or HMAC Authentication
  • Internal/Client APIs: Client API Key Authentication
  • User Dashboard APIs: JWT Bearer Token (handled automatically by the dashboard)

Method 1: Source Bearer Token (Recommended)

The simplest way to authenticate lead submissions. Use a Source Token obtained from your BidYard dashboard.

Where to find your Source Token

Dashboard → Sources → Your Source → Tokens tab

Usage

POST /v1/leads HTTP/1.1
Authorization: Bearer YOUR_SOURCE_TOKEN
Content-Type: application/json

Example

curl -X POST https://api.bidyard.dev/v1/leads \
  -H "Authorization: Bearer your_source_token" \
  -H "Content-Type: application/json" \
  -d '{
    "firstName": "John",
    "lastName": "Doe",
    "email": "[email protected]",
    "phone": "555-123-4567"
  }'

Method 2: HMAC Signature Authentication

For enhanced security, sign each request with HMAC-SHA256. This ensures request integrity and prevents tampering.

Where to find your credentials

Dashboard → Sources → Your Source → Settings tab (Source Key & Secret)

Required Headers

  • X-Source-Key: Your source key
  • X-Signature: HMAC-SHA256 signature of the request body

Signature Computation

signature = HMAC-SHA256(request_body, source_secret)

JavaScript Example

const crypto = require('crypto');

const requestBody = JSON.stringify({
  firstName: 'John',
  lastName: 'Doe',
  email: '[email protected]',
  phone: '555-123-4567'
});

const signature = crypto
  .createHmac('sha256', sourceSecret)
  .update(requestBody)
  .digest('hex');

fetch('https://api.bidyard.dev/v1/leads', {
  method: 'POST',
  headers: {
    'X-Source-Key': sourceKey,
    'X-Signature': signature,
    'Content-Type': 'application/json'
  },
  body: requestBody
});

Python Example

import hmac
import hashlib
import json
import requests

request_body = json.dumps({
    'firstName': 'John',
    'lastName': 'Doe',
    'email': '[email protected]',
    'phone': '555-123-4567'
})

signature = hmac.new(
    source_secret.encode('utf-8'),
    request_body.encode('utf-8'),
    hashlib.sha256
).hexdigest()

requests.post(
    'https://api.bidyard.dev/v1/leads',
    headers={
        'X-Source-Key': source_key,
        'X-Signature': signature,
        'Content-Type': 'application/json'
    },
    data=request_body
)

cURL Example

REQUEST_BODY='{"firstName":"John","lastName":"Doe","email":"[email protected]","phone":"555-123-4567"}'
SIGNATURE=$(echo -n "$REQUEST_BODY" | openssl dgst -sha256 -hmac "$SOURCE_SECRET" | sed 's/^.* //')

curl -X POST https://api.bidyard.dev/v1/leads \
  -H "X-Source-Key: $SOURCE_KEY" \
  -H "X-Signature: $SIGNATURE" \
  -H "Content-Type: application/json" \
  -d "$REQUEST_BODY"

Method 3: Client API Key

For accessing other API endpoints beyond lead delivery (campaigns, buyers, etc.).

Where to find your Client API Key

Dashboard → Organization → Settings tab → API Keys

Usage

GET /v1/campaigns HTTP/1.1
X-API-Key: YOUR_CLIENT_API_KEY

Need Help?