Keys for your developer
Everything your developer needs is on your platform’s Connection tab. What to send, how to send it safely, and what to do if a key leaks.
On this page
Find the Connection tab
Open your platform and choose Connection. The card at the top lists what is left: Create an API key, Generate a secret key, Add AdQuest to your app and First completion, each with an Open link. Below it are four tabs: Keys, Reward notices, Where it runs and Embed code.
What you will find
| Item | Where | Secret? | Who needs it |
|---|---|---|---|
| API key (aqk_) | Keys. Choose Create Key; the key is shown once. | No. It is safe inside your app. | Your developer, for the app or site. |
| Secret Key (aqs_) | Keys. Choose Generate secret key; it is shown once. | Yes. Server only. | Your developer’s server. |
| Event signing secret | Keys. Choose Generate. | Yes. Server only. | Your developer, if your server proves verified events or multi-step steps. |
| Embed URL | Embed code. Appears after approval. | No. | Your developer, for an iframe or WebView. |
| Webhook signing secret (whsec_) | Reward notices. Shown when you add a webhook. | Yes. | Your developer’s server, to check each notice. |
Send this to your developer
- The API key (aqk_).
- The Secret Key (aqs_), through a password manager. Never in chat, a ticket or an email.
- The Embed URL, if they use an iframe or WebView.
- The Event signing secret, if your server proves verified events or multi-step steps.
- The webhook signing secret, if they set up reward notices.
- A link to the developer documentation: /docs.
Reward notices
Ask your developer for the address that should receive notices.
On Reward notices, choose Add webhook and paste the address under Webhook URL.
Under Notices to send, pick what they need: A player finishes a quest, Someone wins a prize, or A reward needs fulfilling by you (this one needs https).
Tick Send test notices only while you test, then choose Save webhook.
Copy the Signing secret that appears and send it to your developer through a password manager.
Recent notices lists every delivery. After your developer fixes their server, Send again delivers a notice once more.
If a key is lost or leaked
| Key | What to do | The old one |
|---|---|---|
| API key | Choose Rotate on its row, or Revoke to remove it for good. | Stops working at once. Update the app straight away. |
| Secret Key | Choose Rotate secret key. | Keeps working for 24 hours, so your developer can switch the server first. |
| Event signing secret | Choose Rotate. | Keeps working for 24 hours. |
| Webhook signing secret | Choose New signing secret on the webhook. | Stops working at once. |
Where AdQuest may appear (optional)
On the Connection tab, open Where it runs.
Under Website addresses, add each address your app runs on, one per line, with https:// and the port if there is one, such as https://app.example.com. Leave out page paths.
For a mobile app, fill in App package name instead, such as com.example.app.
Choose Save Restrictions.