Authentication

To authenticate API requests, clients must generate a signature using the provided secret key and include it in the request header. X-Signature

Signature Calculation

The signature generation process involves hashing the request body using the HMAC-SHA256 algorithm and the secret key.

Example Merchant Secret Key

secret_key = 1234567890abcdef1234567890abcdef1234567890abcdef

Example Payload:

{
  "merchant_id": "AA12345678",
  "token": "testtokentesttokentesttokentesttokentesttoken",
  "time": 1656272222
}

the following examples show the calculation of signature in php and nodejs.

<?php

$data = [
  "merchant_id" => "AA12345678",
  "token" => "testtokentesttokentesttokentesttokentesttoken",
  "time" => "1656272222"
];
$post_data = json_encode($data);
$secret_key = '1234567890abcdef1234567890abcdef1234567890abcdef';
$signature = hash_hmac("SHA256", $post_data, $secret_key);
echo $signature . "\n";

js:

const crypto = require('crypto');

const data = {
  merchant_id: "AA12345678",
  token: "testtokentesttokentesttokentesttokentesttoken",
  time: "1656272222"
};

const postData = JSON.stringify(data);
const secretKey = '1234567890abcdef1234567890abcdef1234567890abcdef';

const signature = crypto.createHmac('sha256', secretKey)
                    .update(postData)
                    .digest('hex');

console.log(signature);