API-Key & Signature, Timestamp
Every Tillo API request requires three authentication headers:
API-Key: Your API key Signature: HMAC-SHA256 hash of a specific data string Timestamp: Current timestamp in milliseconds since Unix epoch
The signature is computed by:
Building a data string from request parameters
Computing HMAC-SHA256 of that string using your secret
Encoding the result as a hexadecimal string
For a step-by-step walkthrough, see the Generate a signature recipe here:
IP Whitelisting
As an additional layer of security, you will need to whitelist your IP address before being able to make requests to our API. You can manage your IP White list within the API management pages.