The Developer API page lets advertisers create scoped API keys for account, ad-pack, campaign, and reporting access. Send the key in the Authorization: Bearer header and keep it outside public JavaScript or source repositories. Optional IP or CIDR restrictions and per-minute rate limits can reduce exposure.
Webhook endpoints must use public HTTPS URLs. Each JSON request includes an event name, delivery ID, event ID, timestamp, and data object. Verify the X-EarnGrid-Signature header by calculating an HMAC-SHA256 digest of the raw request body with the endpoint signing secret. Store event IDs so repeated deliveries are processed only once.
The administrator must run the webhook retry cron regularly. Failed endpoints use exponential retry delays and may be paused after repeated failures.