Get started
Authentication
SprintCheck has two credential types, one for encryption and the other for authentication. Every request must carry each of them in the headers.
Credential types
| Credential | Used by | Header |
|---|---|---|
| API key | API request, SDK or Libraries | Authorization: <api_key> |
| Encryption Key | API request, SDK or Libraries | signature: <hmac value> |
API keys
An API key is issued when your business account is created — a test key for sandbox and a live key for production. Find them under Developers in your dashboard, where you can also rotate them at any time.
Keys are secrets. Keep them server-side, never ship them in mobile or browser code, and rotate immediately if one leaks — regeneration invalidates the old pair at once.
Encryption key
Sign in to your SprintCheck dashboard and retrieve your unique encryption key. This key must be kept secure and never exposed publicly.
Before making an API call, compute the signature by hashing the request body with your encryption key using HMAC-SHA512, then send the result as signature: <hmac value> on every request.
hash_hmac("SHA512", $payload, $ENCRYPTION_KEY)