Authentication

To call the authenticated public API you first need a User Key.

Use the authentication exchange endpoint documented here:

GET /authenticate/apikeyexchange

For the initial exchange:

• send Portal username and password as query parameters
• send X-MSS-API-APPID, X-MSS-CUSTOM-DATE, and X-MSS-SIGNATURE headers

Signing requests

Portal signs requests with HMAC-SHA256 and Base64-encodes the result.

Build the canonical message by concatenating these parts with no separator:

[HTTP method][absolute URL][content type][timestamp][user API key]

Rules:

• Use the full absolute URL, including the query string when present.
• Query parameters must be encoded exactly as sent.
• For GET requests, omit the content-type segment.
• For non-GET requests, include the exact content type sent in the request.
• The timestamp must exactly match X-MSS-CUSTOM-DATE.
• The user API key must exactly match X-MSS-API-USERKEY.
• For the initial exchange, the user API key is empty in both places.
• Use the Secret Key as raw ASCII bytes. Do not base64-decode it before computing the HMAC.

Example canonical message for the initial exchange:

GEThttps://api.portal.io/authenticate/apikeyexchange?UserName=user%40example.com&Password=MyP%40ss123Mon, 06 Apr 2026 00:22:19 GMT

If the exchange succeeds, use meta.apiKey from the response on all later authenticated requests. For the HMAC-based public API, this is the value that matters, not bearerToken.