API access

ℹ️

Authorization is not required for the emission and sending of events related to interactions (clicks, views) and attributions (wishlist, cart, purchase).

A subset of the AdsHero API is publicly accessible — this primarily includes emission and sending interactions and attribution events. The remaining APIs are secured and require authentication via a token.

If the API requires authentication, it is indicated in the documentation as follows:

🛡

This API is secured — you need to pass access token in the Authorization header.

This means that each request must include the Authorization header with the value Bearer {access_token} (the {access_token} part should be replaced with the actual token obtained as described below).

Obtaining a Token

We provide a standard OIDC (OpenID Connect) endpoint at the following address:

https://api.adshero.io/v1/oauth/token

Authentication is done using the “password grant”. To obtain the username and password (and thus access to the API), please contact us. The API does not accept the credentials of regular user panel users.

Example request:

POST https://api.adshero.io/v1/oauth/token HTTP/2
Content-Type: application/x-www-form-urlencoded

grant_type = password &
client_id = public-api &
username = username &
password = password

username and password parameters should be replaced with actual ones.

curl --location --request POST 'https://api.adshero.io/v1/oauth/token' \
     --header 'Content-Type: application/x-www-form-urlencoded' \ 
     --data-urlencode 'grant_type=password' \ 
     --data-urlencode 'client_id=public-api' \ 
     --data-urlencode 'username={username}' \ 
     --data-urlencode 'password={password}'

username and password parameters should be replaced with actual ones.

The response returns a JSON object in the following format:

HTTP/2 200 OK
Content-Type: application/json

{ 
  "access_token": "string", 
  "expires_in": "int", 
  "refresh_expires_in": "int", 
  "refresh_token": "string", 
  "token_type": "string", 
  "not-before-policy": "int", 
  "session_state": "string", 
  "scope": "string"
}

The access_token field should be passed as the Authorization header:

Authorization: Bearer {access_token}

expires_in indicates how many seconds until the token expires (is no longer accepted by the API). After this time, a new token must be obtained.

Events