generated: '2026-08-06'
method: searched
source: >-
  openapi/applike-justtrack-management-openapi.yml, openapi/applike-justtrack-app-events-openapi.yml,
  https://docs.justtrack.io/api/overview/, https://docs.justtrack.io/api/revenue-events-api/api-for-customers/,
  https://docs.adjoe.io/rewarded-solutions/reporting-apis/revenue-api,
  https://docs.adjoe.io/rewarded-solutions/setting-up-rewarding/server-to-server-payouts
docs:
- https://docs.justtrack.io/api/overview/
- https://docs.justtrack.io/sdk/find-your-justtrack-token/
summary: >-
  Every AppLike Group API surface is API-key authenticated. There is no OAuth 2.0, no OpenID Connect, no mTLS and no
  bearer-token flow anywhere in either brand's public developer surface — which is why no scopes/ artifact exists for
  this provider. justtrack issues one organization API key from the dashboard user profile and expects it in an
  X-API-Key header; the revenue sink takes the same key as an `apikey` query parameter instead. adjoe uses a
  per-publisher "Publisher token" from the Monetize Dashboard in an X-API-KEY header. The adjoe rewarded payout
  callback is not key-authenticated at all — it is verified by an SHA-1 signature (`sid`) computed over the payout
  fields plus a shared `s2s_token`.
schemes:
- id: justtrack-api-key-header
  type: apiKey
  in: header
  name: X-API-Key
  applies_to:
  - justtrack Management API
  - justtrack AppEvent API
  - justtrack Reporting API
  issuance: >-
    Generated by the account holder in the justtrack dashboard: User profile page > API keys > "Generate new key".
  scope_model: none — the key carries the organization's full permissions; no scoping or per-key permissions documented
  gating: Documented as a Pro-plan feature.
  evidence: https://docs.justtrack.io/api/overview/
  spec_declared: true
  spec_source: openapi/applike-justtrack-management-openapi.yml components.securitySchemes.ApiKeyAuth
- id: justtrack-api-key-query
  type: apiKey
  in: query
  name: apikey
  applies_to:
  - justtrack Revenue Events API (customer variant)
  note: >-
    The revenue sink accepts the API key as a query-string parameter rather than a header, which means the credential
    appears in URLs and therefore in intermediary logs. This is a genuine divergence from the header-based scheme the
    OpenAPI contracts declare, not a documentation error.
  evidence: https://docs.justtrack.io/api/revenue-events-api/api-for-customers/
- id: adjoe-publisher-token
  type: apiKey
  in: header
  name: X-API-KEY
  applies_to:
  - adjoe SSP Revenue API
  - adjoe User Ad Data Report API
  issuance: >-
    The publisher token from the adjoe Monetize Dashboard: profile icon > MY PROFILE > Publisher token.
  scope_model: none — one token per publisher account
  evidence: https://docs.adjoe.io/rewarded-solutions/reporting-apis/revenue-api
- id: adjoe-s2s-signature
  type: signature
  algorithm: SHA-1
  parameter: sid
  applies_to:
  - adjoe server-to-server rewarded payout callback
  construction: sid = sha1(concatenate(trans_uuid, user_uuid, currency, coin_amount, device_id, sdk_app_id, s2s_token))
  verification: >-
    The receiving publisher recomputes the sid with its own s2s_token and compares it with the value adjoe sent.
    Requests whose sid does not match must be rejected.
  note: >-
    SHA-1 concatenation is the weakest primitive on this provider's surface. It is unkeyed HMAC (a plain hash of a
    concatenated string including a shared secret), which is susceptible to length-extension and offers no algorithm
    agility. Recorded as observed; this is a finding to raise with adjoe, not a defect in this artifact.
  evidence: https://docs.adjoe.io/rewarded-solutions/setting-up-rewarding/server-to-server-payouts
- id: justtrack-sdk-token
  type: apiKey
  in: sdk-initializer
  name: apiToken
  applies_to:
  - justtrack mobile SDKs (Android, iOS, Unity, React Native, Godot)
  note: Client-side app token used to initialize the SDK; distinct from the dashboard API key.
  evidence: https://docs.justtrack.io/sdk/find-your-justtrack-token/
- id: adjoe-sdk-hash
  type: apiKey
  in: sdk-initializer
  name: sdkHash
  applies_to:
  - adjoe Playtime SDK
  - adjoe SSP Revenue API (as a path parameter identifying the SDK/app)
  evidence: https://docs.adjoe.io/rewarded-solutions/integration/playtime-sdk-for-android
not_supported:
  oauth2: not documented on any surface
  openIdConnect: no /.well-known/openid-configuration on any host (all probes 404)
  mutualTLS: not documented
  jwt_bearer: not documented
  scopes: >-
    none. No scope, permission or role model is published for any API key, so scopes/ is intentionally absent rather
    than empty.
key_rotation:
  documented: partial
  detail: >-
    justtrack documents generating a new key from the user profile page but publishes no rotation policy, key
    expiry, or multi-key/per-environment guidance. adjoe documents where to copy the publisher token but not how to
    rotate it.
transport:
  https_required: true
  observed: all documented endpoints are https-only