generated: '2026-08-26'
method: searched
source: 'https://github.com/prizeout/swift-builds/wiki/How-To-Integrate ; https://github.com/prizeout/android-sdk-builds/wiki/How-To-Integrate ; https://docs.livelike.com/docs/prizeout-integration'
docs: https://github.com/prizeout/swift-builds/wiki/How-To-Integrate
name: Prizeout Authentication
description: >-
  Prizeout has no public OpenAPI, so no securityScheme could be derived. The authentication model is
  reconstructed from the two first-party SDK integration wikis Prizeout publishes on GitHub and from
  a partner platform (LiveLike) that documents the four credentials Prizeout issues. The model is
  shared-secret / API-key, not OAuth: there is no authorization server, no scope surface, and no
  /.well-known/openid-configuration or /.well-known/oauth-authorization-server on any Prizeout host
  (both probed 404 on 2026-08-26).
schemes:
- id: partner_api_key
  type: apiKey
  in: sdk-credential
  name: apiKey
  description: >-
    Partner API key passed to the SDK at initialisation alongside partnerId. Issued from the
    Prizeout Partners Dashboard under Account Settings. Prizeout issues two sets - sandbox
    credentials for initial testing and production credentials once integration and testing are
    complete.
  evidence: 'setCredentials(sessionId:partnerId:partnerName:apiKey:userId:email:balance:environment:) in the Swift SDK wiki'
- id: partner_api_secret
  type: apiKey
  in: server-side
  name: API Secret Key
  description: >-
    Server-side secret, distinct from the API key. Documented by LiveLike as one of the four values
    a partner enters to connect Prizeout. Not passed to the client SDK.
  evidence: 'https://docs.livelike.com/docs/prizeout-integration - "Partner ID, API Key, API Secret Key, and HTTP Security Token"'
- id: http_security_token
  type: apiKey
  in: header
  name: HTTP Security Token
  description: >-
    Shared token Prizeout presents when it calls the partner-hosted callback endpoints (balance
    check, session, cash-out success, cash-out failure), so the partner can authenticate the inbound
    request. This is the reverse direction from the API key - it authenticates PRIZEOUT to the
    PARTNER. The exact header name is not published publicly.
  evidence: 'https://docs.livelike.com/docs/prizeout-integration'
  gap: 'Header name and signature algorithm are not documented on any public Prizeout surface.'
identity_fields:
- name: partnerId
  description: 'Partner/publisher identifier (a UUID in the JavaScript SDK - settings.publisher.id or settings.partner_id).'
- name: partnerName
  description: 'Human-readable partner name (iOS SDK only).'
- name: sessionId
  description: 'Per-user session identifier the partner mints and Prizeout validates back against the partner session callback.'
- name: userId
  description: 'Partner-scoped user identifier.'
- name: email
  description: 'End-user email; the gift card is delivered to it.'
- name: balance
  description: >-
    Cash-out balance in minor units, or a balanceMin/balanceMax range, or one of the pre-set
    BalanceBin enums (11 bins in iOS, 10 in Android, from min000_max10000 to min5000000_maxUnlimited).
    A bin lets a partner disclose a range instead of an exact balance.
oauth2: false
openid_connect: false
mtls: false
scopes: none
notes:
- 'scopes/ was deliberately not authored: Prizeout has no OAuth surface, so an OAuthScopes artifact
  would be an empty shape. derive-oauth-scopes.py confirmed 0 oauth2 schemes.'
- 'The backend hosts named in the widget bootstrap (py-merchant-portal-api.prizeout.com and the
  brand API on Cloud Run) return HTTP 403 to anonymous requests on every path probed, including
  /openapi.json, /docs, /redoc and /graphql. They are real Prizeout services but are not a public
  API surface.'
gaps:
- 'No public authentication reference page. The only published auth documentation is inside two
  GitHub wikis for SDKs described as being in private testing.'
- 'Credential rotation, expiry and revocation are undocumented.'
- 'No signature scheme is published for the partner callbacks, so a partner has only a shared bearer
  token to distinguish a genuine Prizeout cash-out callback from a forged one.'