AltoPocket Integrations API
A server-to-server integration for approved partner platforms. Every request is signed with your key; what an approved key can do is shown after approval, in the developer console.
How it works
Approved partners only
Apply with your company, contact and server IPs. An AltoPocket operator reviews every application.
Capabilities after approval
Once approved, your key shows what it can be granted in the developer console, and you request what you need with a reason.
Signed, server to server
Every call carries your key and an HMAC signature, from the server IPs on your allowlist.
Nothing that moves value runs on its own: an AltoPocket operator approves it.
How requests are signed
Each request carries your API key (x-api-key), a Unix timestamp (X-AP-Timestamp, within ±5 minutes) and X-AP-Signature: an HMAC-SHA256 with your signing secret over the timestamp, the HTTP method, the path including the query string, and the SHA-256 of the exact body bytes, joined by newlines. Every POST also carries an Idempotency-Key. Calls are accepted only from the server IPs on your allowlist.
The Swagger reference can sign "Try it out" requests in your browser. Use sandbox keys there only — never paste a live signing secret into a browser.
The public reference shows signing, the connectivity check and the application only. Approved partners see the full reference for their permissions: on the Swagger page enter your sandbox key and choose “Unlock full docs”, or fetch GET /integrations/v1/docs/openapi.json (signed) from your server.
Testing from Swagger
Try it out signs each request in your browser, so the request comes from your browser’s public IP, and that IP must be admitted for your key: one of your production IPs, a sandbox tester IP, or a sandbox “allow any IP” setting an AltoPocket operator can turn on for your client. The signing panel’s “Check my IP” shows the IP the API sees, and a refused call tells you which IP was refused. Never paste a live signing secret into a browser.
canonical = timestamp + "\n"
+ METHOD + "\n"
+ path_with_query + "\n"
+ hex(sha256(raw_body))
X-AP-Signature = hex(hmac_sha256(secret, canonical))
x-api-key = apk_…
X-AP-Timestamp = unix seconds (±300 s)
Idempotency-Key = <every POST>Environments
Live
Production. Keys start with apk_live_ and are issued separately from sandbox keys.
https://api.altopocket.com/api/v1/integrations/v1
Permissions are requested after approval
An application asks for no permissions. Once your key is approved and collected, the developer console (or GET /integrations/v1/scopes with your key) shows what each permission allows, and you request the ones you need with a justification. An operator reviews every request.
Apply for an API key
No account needed. Tell us who you are, which server IPs will call us and what you will build. An application asks for no permissions: once it is approved you collect your key once with the status token, then request the permissions you need with that key in the developer console. An operator reviews every application and every permission request.