2.1 Authentication

We expect you to implement HTTP Basic authentication. Every request MollyBet makes to you carries an Authorization header in this form:

Authorization: Basic base64(UTF-8 encoded "username:api_key")

For example:

Authorization: Basic dXNlcm5hbWU6YXBpa2V5

2.1.1 Credentials

At a minimum we expect a single account with a shared secret API key. The API key should be a long random string, which you provide to us.

Support for multiple usernames is optional. If you do support them, how you organise your users is entirely up to you — we simply send whichever credentials you have issued us.

2.1.2 Scope

Every endpoint is defined as requiring Basic authentication. In practice you should authenticate all of them, /account included: it is the endpoint we call first to verify that the credentials we hold are valid and the account is active.