Authentication

API keys, signed-in routes and the Stripe signature, and what each route accepts.

API access

API access is opened with your account. Email hello@viewpayout.com and we set up your account and send the key. A key belongs to an account, not to a workspace.

Once you have a key, send it as a bearer token. A missing, malformed or revoked key answers 401 unauthorized. Keys are rate limited, and a limited request answers 429 rate_limited with a Retry-After header.

Signed-in routes

The billing routes under /v1/me/billing are for the signed-in dashboard. They accept a Firebase ID token of the signed-in user, not an API key.

Stripe webhook

The route /v1/billing/webhook is for Stripe only and checks Stripe's signature over the raw request body. A request without a valid signature answers 400 signature_invalid. A verified paid top-up adds its pack to the brand balance, and nothing else grants money.

Operator actions

Funding a balance by hand, approving cashouts and payouts and resolving the review queue are done by our team, not through the public API. Email hello@viewpayout.com for any of them.

Scheduled jobs

Views are read every hour, and every post whose hold has ended is settled every day. Both runs are safe to repeat.