Authentication Intro

TubeMogul offers two types of authentication -- standard auth and partner (or 3rd party) auth. Standard auth is designed for applications which deal with one TubeMogul account, like individual users and corporations. For multi-user apps like video sharing sites and platforms who are performing TubeMogul functionality on the behalf of many 3rd party users, partner authentication is the preferred method of authentication.

Both methods use the same querystring hashing mechanism decribed below.

Standard Authentication

NOTE: Partners please refer to Partner Authentication.

Every TubeMogul developer will be provided with a user ID and a secret key that are cryptographically unrelated but that are linked together within the TubeMogul database to form credentials. In order to authenticate every communication, a number of global parameters are required on each call.

Every request to the API will contain a parameter named "auth" that ensures a secure authentication mechanism as described below. The SHA-1 algorithm is utilized to generate the hash in order protect the secrecy of the secret key. More detail and sample requests are provided below for each of the two content-types utilized by the API.

For all methods EXCEPT upload_video, a application/x-www-form-urlencoded request is made with a hash parameter generated by prepending the secret key to the entire request query string and then applying a SHA-1 hash to the resulting string. For the upload_video method ONLY, a multipart/form-data request is made with a hash parameter generated by concatenating the secret key, the user token, the API method being called, the partner ID, a UNIX timestamp, the video title, and the video filename and then applying a SHA-1 hash to the resulting string.

Information on the SHA-1 hash algorithm is available from the W3C here. An online demo of the algorithm is available from WebToolkit here that can be used to verify your implementation.

Partner Authentication (partners only)

Please refer to our Partner Authentication document.

How to Create the querystring and auth token

Important Note: All parameters sent in application/x-www-form-urlencoded requests must be URL encoded according to RFC 1738.

List of variables:

secret_key: 78d393df54275b42152127b672ed865a6f2d1ef0
(provided by TubeMogul, this is NEVER transmitted over the Internet)

user_id: 3983
(provided by TubeMogul)

method: get_video_status
(displays the status for an uploaded video)

date: 1189384112
(UNIX timestamp that must be generated each time a request is being built)

upload_id: 3098
(a required parameter for get_video_status method)

Complete string to be hashed:

Prepend the secretKey to the entire request query string:

78d393df54275b42152127b672ed865a6f2d1ef0user_id=3983&method=get_video_status&date=1189384112&upload_id=3098

auth: 5bb6dea18918af22bfe561c2013ab978ee8bca77
(SHA-1 hash of the string above)

Actual request body:

user_id=3983&method=get_video_status&date=1189384112
&upload_id=3098&auth=5bb6dea18918af22bfe561c2013ab978ee8bca77

Sample multipart/form-data Request

Note: Parameters sent in multipart/form-data requests should *NOT* be URL encoded.

List of Variables:

secret_key: 78d393df54275b42152127b672ed865a6f2d1ef0
(provided by TubeMogul, this is NEVER transmitted over the Internet)

user_id: 3983
(provided by TubeMogul)

method: upload_video
(uploads a video to a user's TubeMogul account)

date: 1189384519
(UNIX timestamp that must be generated each time a request is being built)

title: my pets
(a required parameter for upload_video method)

tags: dog, cat, farm
(a required parameter for upload_video method)

description: my dog attacks my cat
(a required parameter for upload_video method)

category: 13
(a required parameter for upload_video method)

token: 1342342083
(obtained from call to which_host method; a required parameter for upload_video method)

file: [BINARY DATA FOR FILE: pets.mpeg]
(the filename is not sent separately since it is received in the file information)

Complete string to be hashed:

Concatenate the secret_key, the user_id, the method name being called, the date, the video title, and the video filename.

78d393df54275b42152127b672ed865a6f2d1ef03983upload_video
1189384519my petspets.mpeg

auth: f73fd840bf342a6e2d3ef03af9df2fe289846c96
(SHA-1 hash of the string above)

Actual request body:

------------ei4cH2ae0cH2ei4Ef1Ef1GI3KM7GI3
Content-Disposition: form-data; name="user_id"

3983
------------ei4cH2ae0cH2ei4Ef1Ef1GI3KM7GI3
Content-Disposition: form-data; name="method"

6bb13cb12d3f3926e927679b1b7c43547dd6af10
------------ei4cH2ae0cH2ei4Ef1Ef1GI3KM7GI3
Content-Disposition: form-data; name="date"

1189384519
------------ei4cH2ae0cH2ei4Ef1Ef1GI3KM7GI3
Content-Disposition: form-data; name="title"

my pets
------------ei4cH2ae0cH2ei4Ef1Ef1GI3KM7GI3
Content-Disposition: form-data; name="token"

1342342083
------------ei4cH2ae0cH2ei4Ef1Ef1GI3KM7GI3
Content-Disposition: form-data; name="tags"

dog, cat, farm
------------ei4cH2ae0cH2ei4Ef1Ef1GI3KM7GI3
Content-Disposition: form-data; name="description"

my dog attacks my cat
------------ei4cH2ae0cH2ei4Ef1Ef1GI3KM7GI3
Content-Disposition: form-data; name="category"

13
------------ei4cH2ae0cH2ei4Ef1Ef1GI3KM7GI3
Content-Disposition: form-data; name="file"; filename="pets.mpeg"
Content-Type: application/octet-stream

[BINARY DATA FOR FILE]
------------ei4cH2ae0cH2ei4Ef1Ef1GI3KM7GI3
Content-Disposition: form-data; name="auth"

f73fd840bf342a6e2d3ef03af9df2fe289846c96
------------ei4cH2ae0cH2ei4Ef1Ef1GI3KM7GI3--