Skip to main content

​
Authentication

​
Webhook headers

Airlead webhook endpoints accept a configured secret in either header:
Send Content-Type: application/json with JSON requests.

​
Source ingest secret

Each webhook source can have its own ingest secret.
  • If a secret is configured, every request must provide it.
  • If no secret is configured, that source accepts requests without this credential.
Always configure a strong, unique secret before production traffic.

​
Buyer lifecycle secret

Confirmation, rejection, payout, and cancellation callbacks use the webhook secret of the buyer associated with the transaction.
  • Invalid or missing credentials return 401.
  • If the buyer has no required secret configured, the endpoint can return 403.
Do not use a source secret for buyer lifecycle calls.

​
Connect secret

A Connect endpoint can require a separate Connect secret. When enabled, the sender must provide it while resolving or delivering to that endpoint.

​
Store and rotate secrets safely

  • Store secrets in an encrypted secret manager or environment variable.
  • Never commit them to source control.
  • Never include them in URLs.
  • Redact headers from logs and error reports.
  • Use different secrets for development, staging, and production.
  • Rotate a secret immediately if it is exposed.
  • Coordinate rotation to avoid losing production deliveries.

​
In-app APIs

The Airlead web app uses user sessions and permissions for its own endpoints. A browser session or internal application credential is not a supported partner API authentication method. Next: API authentication · Errors, retries, and limits