Launchmetrics Authentication

generated: '2026-08-17'
method: searched
source: https://nap.launchmetrics.com/docs/search.html
docs: https://nap.launchmetrics.com/docs
note: >-
  Derived by reading the public NAP API reference at nap.launchmetrics.com/docs, which repeats an
  identical "Authentication" section on every one of the five service pages (Search, Documents,
  Documents v2, Medias, Auditlogs). Launchmetrics publishes no OpenAPI securitySchemes block that
  could be parsed mechanically, so every field below is transcribed from the published prose.
  Launchmetrics is not an OAuth provider; there is no authorization server, no scope surface and no
  /.well-known/openid-configuration on any Launchmetrics host (all probed 404 or SPA-shell).
summary:
  types:
  - apiKey
  - custom-signature
  api_key_in:
  - query
  oauth2_flows: []
  oauth2: false
  openid_connect: false
schemes:
- name: app_id
  type: apiKey
  in: query
  parameter: app_id
  required: true
  description: >-
    An application identifier issued by Launchmetrics R&D. The docs describe app_id-only requests as
    the "less secure" of the two supported modes. The legacy spellings appId and appid are documented
    as deprecated; app_id is the current parameter name.
  issuance: >-
    Not self-service. The reference says "if you don't have an app_id you should request one" and that
    the app_id and its secret are "provided by R&D" — there is no public sign-up, developer console or
    key-provisioning endpoint.
  sources:
  - https://nap.launchmetrics.com/docs/search.html
  - https://nap.launchmetrics.com/docs/documents.html
  - https://nap.launchmetrics.com/docs/documentsV2.html
  - https://nap.launchmetrics.com/docs/medias.html
  - https://nap.launchmetrics.com/docs/auditlogs.html
- name: app_id + signature
  type: custom-signature
  in: query
  algorithm: HMAC-SHA1
  encoding: base64
  required: false
  description: >-
    The "more secure" mode. Requests carry app_id, nonce, timestamp and signature query parameters.
    The scheme is explicitly modelled on the OAuth 1.0a-era Twitter request-signing recipe, which the
    docs cite as their source (dev.twitter.com/docs/auth/creating-signature).
  parameters:
  - name: app_id
    description: Application identifier issued by Launchmetrics R&D.
  - name: nonce
    description: Random string of at least 32 characters.
  - name: timestamp
    description: Current time in seconds since the Unix epoch.
  - name: signature
    description: Base64-encoded HMAC-SHA1 of the signature base string, keyed with the app secret.
  signature_base_string: 'http_method&url_encoded(request_url)&url_encoded(parameter_string)'
  signature_steps:
  - Add timestamp, nonce and app_id to the request parameters.
  - Percent-encode every key and value (spaces as %20, never +, or the signature will not match).
  - Join each key and value with "=" and sort the resulting list alphabetically.
  - Join all parameters with "&" to produce the parameter_string.
  - Build signature_base = HTTP_METHOD & url_encoded(request_url) & url_encoded(parameter_string),
    where request_url excludes the protocol and any query parameters.
  - For non-form bodies (JSON or plain text), append a newline and the raw body bytes to signature_base.
  - HMAC-SHA1 signature_base with the app secret and base64-encode the binary output.
  - Send signature alongside the other parameters. For POST/PUT with a non-form body, the signature
    parameters must be placed on the URL query string, not in the body.
  sources:
  - https://nap.launchmetrics.com/docs/search.html
observed_behaviour:
- probe: GET https://nap.launchmetrics.com/search/v1/ping
  http_status: 200
  note: Health endpoints answer unauthenticated; /ping returned {"pong":"ok"} inside the NAP envelope.
- probe: GET https://api-ter.launchmetrics.com/v1/openapi.json
  http_status: 401
  body_code: APP_ID_NOT_VALID
  note: >-
    A machine-readable OpenAPI document exists on the api-ter host but is gated behind a valid app_id;
    an unauthenticated request returns 401 APP_ID_NOT_VALID rather than 404. Recorded as evidence of a
    gated contract, not saved — see conformance/ and the x-enrichment notes.
- probe: GET https://api-ter.launchmetrics.com/v0/openapi.json
  http_status: 400
  body_code: MISSING_TENANT
  note: The v0 (test) route additionally requires a tenant parameter.
gaps:
- No OAuth 2.0, OpenID Connect or mutual-TLS surface is documented or discoverable.
- No published token rotation, expiry or revocation policy.
- No self-service credential issuance; app_id and secret are handed out by Launchmetrics R&D.
- HMAC-SHA1 is the only signing algorithm offered; no SHA-256 option is documented.