According to the documentation, you concatenate your key, your secret, your unix timestamp and do a sha256 hash of these and pass it in a header.
You’ll need the plug-in to calculate that, then feed it into your API call.
Presumably the request itself has a timestamp in. These must match.
You’ll need bubble fields or states or whatever to calculate the hash, then feed it into the api. The add in needs you to have a copy of the hash generator on the page, which is invisible.
Calculating a hash signature on the page is all well and nice, except it exposes the secret to the browser, ie. the end user.
When doing a hash signature on the server, you may be able to use a Bubble function …
On the other hand, I think the API Connector can do the signing for you if configured right. I don’t recall exactly, might be confusing it with Oauth2 and too tired to test … zzzz zzz
Yeah that last bit is way better.
In my own app I stopped using the hash hmac generator on the page and built my own standalone API on alternate server so my credentials were never in bubble itself.