API Authentication - Extra Scoop

You will learn how to secure your programmatic requests to the Extra Scoop platform. The Extra Scoop API exposes specific edge functions for enterprise newsroom integrations. All requests must be authenticated using standard JSON Web Tokens (JWT) or dedicated edge secrets.

Bearer Tokens

For user-scoped actions—such as managing your agency profile or interacting with the dealroom—you must include a valid session JWT in the Authorization header.

Extra Scoop clients (like the Mobile App and Newsroom Terminal) acquire this JWT securely via the PKCE (Proof Key for Code Exchange) flow. Once the PKCE handshake is complete, you use the resulting access token as your Bearer token for all subsequent API calls.

curl -X POST https://api.extrascoop.app/v1/agency/offers \
  -H "Authorization: Bearer YOUR_SESSION_JWT" \
  -H "Content-Type: application/json" \
  -d '{"scoop_id": "123", "amount": 500}'

If a token is expired or missing, the API returns a 401 Unauthorized response.

Server-to-Server Edge Secrets

If you are configuring a custom webhook receiver or a partner integration (like a certified Silicon Trust™ ingestion node), you authenticate using a static edge secret. You pass this via the x-edge-secret header. You can rotate this secret at any time from your developer dashboard.