Get started

To get started:
  1. Request an application key (PhotoDeck account needed)
  2. Upon registration of your application, you should have two keys: the first one is the public API key, the second one is a private secret key shared between PhotoDeck and you (and only you).
    Example:
    API key: 200a3e048fcbf4c9d6392b99a3bd114af4b3700d
API secret: c37912f3900eb26b14aab91d98832b211cdc7791
  3. To call a PhotoDeck API service, you need to set two HTTP headers:
    • X-PhotoDeck-Authorization: API key:signature
    • X-PhotoDeck-Timestamp: current date and time in RFC2822 format
    The signature is the SHA1 hex digest of the following text:
    HTTP method (GET, POST, PUT or DELETE)
requested URL
query string (or empty)
API secret
copy of the X-PhotoDeck-Timestamp content

    Important: the time-stamp should be within a 30 minutes window of the current PhotoDeck servers time.
    If generating a RFC2822 date is too complex, you can revert to a Posix Time / ISO 8601 format (UTC).
    Example of signature calculation for a request to http://api.photodeck.com/ping.xml (assuming that you are running a UNIX system with the sha1sum tool installed):
    $ api_key="200a3e048fcbf4c9d6392b99a3bd114af4b3700d"; api_secret="c37912f3900eb26b14aab91d98832b211cdc7791"
$ request='/ping.xml'; querystring=''
$ timestamp=$(date -R)
$ printf "GET\n$request\n$querystring\n$api_secret\n$timestamp\n" | sha1sum | cut -f1 -d' '
f2c14a1936a1732fda757b0870e08b1df792c2a5
$
    In this example, the calculated signature is f2c14a1936a1732fda757b0870e08b1df792c2a5 when executed at Fri, 25 Jun 2010 12:39:15 +0200.
    It is now possible to call the service with the following headers:
    X-PhotoDeck-Authorization: 200a3e048fcbf4c9d6392b99a3bd114af4b3700d:f2c14a1936a1732fda757b0870e08b1df792c2a5
X-PhotoDeck-Timestamp: Fri, 25 Jun 2010 12:39:15 +0200
    The signature should be calculated for every request.
    Note: if you can’t use SHA1 to calculate the signature, you can revert to MD5. We will auto detect which one is being used.
  4. Call a dummy ‘ping’ service to make sure that your key and signature are recognized.
    GET http://api.photodeck.com/ping.xml — include the X-PhotoDeck-Auhorization and X-PhotoDeck-Timestamp HTTP headers
    You should get in return an XML “OK” message.
    Example from a command line, using curl tool:
    $ api_key='200a3e048fcbf4c9d6392b99a3bd114af4b3700d'; api_secret='c37912f3900eb26b14aab91d98832b211cdc7791'
$ request='/ping.xml'; querystring=''
$ timestamp=$(date -R)
$ sign=$(printf "GET\n$request\n$querystring\n$api_secret\n$timestamp\n" | sha1sum | cut -f1 -d' ')
$ curl -H "X-PhotoDeck-Authorization: $api_key:$sign" -H "X-PhotoDeck-Timestamp: $timestamp" "http://api.photodeck.com$request${querystring:+?$querystring}"
<?xml version="1.0" encoding="UTF-8"?>
<reply>
  <request>GET /ping.xml</request>
  <message>OK</message>
</reply>
  5. Now let’s call a dummy ‘ping_auth’ service that requires user authentication. For now, let’s use HTTP Basic authentication.
    GET http://api.photodeck.com/ping_auth.xml
    You should get in return an XML “OK” message.
    Example from a command line:
    $ api_key='200a3e048fcbf4c9d6392b99a3bd114af4b3700d'; api_secret='c37912f3900eb26b14aab91d98832b211cdc7791'
$ request='/ping_auth.xml'; querystring=''
$ timestamp=$(date -R)
$ sign=$(printf "GET\n$request\n$querystring\n$api_secret\n$timestamp\n" | sha1sum | cut -f1 -d' ')
$ curl -H "X-PhotoDeck-Authorization: $api_key:$sign" -H "X-PhotoDeck-Timestamp: $timestamp" -u john@doe.com "http://api.photodeck.com$request${querystring:+?$querystring}"
Enter host password for user 'john@doe.com':
<?xml version="1.0" encoding="UTF-8"?>
<reply>
  <request>GET /ping_auth.xml</request>
  <message>OK</message>
</reply>
    It’s also possible to pass a text=some text parameter to the ping and ping_auth methods (in the query string). You should get the same text back in return, enclosed in a <input-text> tag.
    When submitting an authenticated request (using HTTP Basic) to the PhotoDeck API, a session cookie is sent back. Attach that session cookie in subsequent requests to avoid using HTTP Basic at each request and storing the user password.
  6. Now, head over to the API documentation