View source

A valid developer key is required for all api calls.  This provides some protection for your applications, for example it will prevent another developer from embedding playlists from your application.  Also it allows us to account for usage and will help identify and handle abusive applications.

You can request and manage your keys on the [http://www.ilike.com/developer Developer Dashboard]

A key is a string of characters:
<pre>
dk01/Mdw+ZuJqr+JItO3MhB8uC7lApfsL+V//6n/XLPV4lQ=
</pre>
It always starts with "dk" and ends with "="

You can use a key in your application either by setting a global variable or by passing it to each api call:
<pre>
//global
_iLikeDevKey = "dk01/Mdw+ZuJqr+JItO3MhB8uC7lApfsL+V//6n/XLPV4lQ=";

// pass to api
iLikeDisplaySong({devKey: "dk01/Mdw+ZuJqr+JItO3MhB8uC7lApfsL+V//6n/XLPV4lQ=", ...});
</pre>

==== Types of keys ====
Keys are available in '''test''' and '''production''' flavors.  Test keys can be used from any domain or Facebook application but have a quota of 1000 calls per 24 hour period (the clock starts the first time you make an api call or the first time you call after a previous quota period has ended).  Production keys have no quota but calls are only accepted from the Facebook application (for the FBML api) and specific domains (for the HTML api) that you specify.

===== Facebook API Key =====
You can find this on the main information page at the [http://www.facebook.com/developers/apps.php Facebook developer site].  This is the public key for your application which Facebook uses in all server requests including ajax requests to iLike.  We ''do not'' need the secret key which is what you use to identify your server side calls to Facebook.

===== HTTP Referer Domains =====
HTTP requests include a Referer header which gives the address of the page that the user is navigating from.  We use this header in the HTML api to verify that the ajax requests are coming from a server which you have specified.

Valid domains are specified as a semi-colon delimited list and can be either exact domain matches or wild-carded to match any sub-domain.  For example:
<pre>
www.example.com
</pre>
would match requests only from www.example.com;
<pre>
*.example.com
</pre>
would match requests from example.com, www.example.com, foo.example.com, or a.really.absurd.domain.name.example.com;
<pre>
*.example.com;www.ilike.com
</pre>
would match requests from example.com (and any sub-domain) or www.ilike.com