Authentication
Platform keys, participant tokens, and how to authenticate SDK and API calls safely.
All AdQuest API calls from the SDK use the public platform key. Balance, lottery entry, and claims also require a participant token.
Headers
| Header | Who sets it | Purpose |
|---|---|---|
X-AdQuest-Platform-Key | Client SDK | Identifies the platform |
X-AdQuest-Participant-Token | Client SDK | Authorizes the end user |
X-AdQuest-Platform-Secret | Host backend only | Mints sessions and privileged ops |
X-AdQuest-Preview-Token | Theme studio preview | Optional preview branding |
Minting participant sessions
POST /api/v1/platform/participant-sessions
X-AdQuest-Platform-Secret: YOUR_PLATFORM_SECRET
Content-Type: application/json
{
"external_user_id": "host-user-123",
"display_name": "Ada"
}
Security tip
Secret API credentials and platform secrets must stay on trusted servers. Never bundle them inside Android, iOS, Unity, or client JavaScript.
Refreshing tokens
When the SDK fires onAuthRequired or the API returns a session error, mint a new token and update the client:
- React: remount or pass a new
participantToken - Embed:
adquest:setParticipantToken
Preview mode
Theme Studio mints a preview token so designers can see unpublished theme JSON. Preview tokens are for branding only — still pair them with a participant session for interactive flows.