Authentication for Register and Unregister

AirBop will authenticate requests to the server using the headers that are passed along with the request. If the headers do not match what AirBop expects then the request will be blocked.

Required Headers

When registering or unregistering with the AirBop servers, the following headers are required:

• x-app-key
• x-timestamp
• x-signature
• Content-Type

They are defined as follows:

x-timestamp

The timestamp of the message, sent as the number of seconds since the Epoch, January 1, 1970 00:00 UTC.

x-app-key

Your AirBop App Key, which is created automatically by AirBop when you create a new app. It is shown on your app's "Edit" tab.

x-signature

An SHA-256 hash constructed exactly as follows:

"POST" + request_uri + AIRBOP_APP_KEY + timestamp + request.body + AIRBOP_APP_SECRET

An example implementation of this can be found in the AirBop-Client sample. This is sometimes known as a HMAC.

Content-Type

This header parameter controls which format the AirBop servers will expect the body to be in (JSON or form url encoded). There are two options:

application/json

Or:

application/x-www-form-urlencoded