Adsourcer Developer

Authentication

Adsourcer supports API keys for integrations and JWT sessions for the advertiser dashboard.

API keys

Server-to-server requests use an API key prefixed with ads_. Keys are hashed at rest and scoped by tenant type — publisher, advertiser, or platform.

http
Authorization: Bearer ads_your_api_key# orX-API-Key: ads_your_api_key

Keep keys secret

Never expose API keys in client-side code or public repositories. Call Adsourcer from your backend or a trusted edge function.

Dashboard sessions

The advertiser dashboard uses short-lived JWT access tokens from POST /v1/auth/login or POST /v1/auth/signup. Pass the token as a Bearer header on dashboard API calls.

http
Authorization: Bearer eyJhbGciOiJIUzI1NiIs...

Social sign-in

The dashboard supports OAuth through Google, GitHub, and Microsoft when configured. OAuth accounts link to existing emails automatically — no duplicate accounts.

OAuth is for dashboard access only. SDK and publisher integrations still use API keys.

Auth endpoints

  • POST /v1/auth/signup
  • POST /v1/auth/login
  • GET /v1/auth/me
  • POST /v1/auth/api-key
  • GET /v1/auth/oauth/{provider}

Related

See Security for key rotation, hashing, and tenant isolation details.