Exchange an RSA-signed proof for a short-lived Bearer token. No bearer is needed on this call — the signed proof is the authentication. Rate-limited to 30 requests/min.
Request body
| Field | Type | Description |
|---|
consumer_key | string | Your API consumer key. |
nonce | string | Unique random string per request (e.g. UUIDv4). |
ts | integer | Unix timestamp (seconds). Must be within the accepted freshness window. |
signature | string | Base64 RSA-SHA256 over the canonical payload below, using your private key. |
What you sign
The canonical string uses the V4 form (version-tagged, key-sorted, length-prefixed — see Request Signing) with version v4.auth over the fields consumer_key, nonce, ts:
v4.auth|consumer_key:32:ck_live_xxxxxxxxxxxxxxxxxxxxxxxxxx|nonce:36:6f9d…|ts:10:1774000000
Example
curl -X POST https://v4api.pokeapay.com/api/v4/auth/token \
-H "Content-Type: application/json" \
-d '{
"consumer_key": "ck_live_…",
"nonce": "6f9d43a2-…",
"ts": 1774000000,
"signature": "Base64(RSA-SHA256(canonical))"
}'
Response — 200
{
"access_token": "…",
"token_type": "Bearer",
"expires_in": 900
}
Errors
| Status | Body | Meaning |
|---|
| 401 | {"error":"auth_failed"} | Unknown key or bad signature. |
| 409 | {"error":"replay_detected"} | Nonce reused, or timestamp stale/in the future. |
Tokens are short-lived; request a new one when expires_in lapses. Send it on every API call as Authorization: Bearer <access_token>.