Authentication & Signature
Pay-in and refund requests are authenticated with two HTTP headers:
| Header | Description |
|---|---|
Sdk-Partner-Token |
Partner credentials in the form service_id:secret. |
X-Signature |
HMAC-SHA256 of the compact (canonicalized) JSON request body, keyed with your Sign Key, hex-encoded. |
Sign the body you actually send. Before verifying, the server parses the received body and re-serializes it as compact JSON — no insignificant whitespace, UTF-8 left unescaped — keeping the fields in the order they arrived. So:
- sign the same field order you transmit; sorting the keys produces a different signature;
- keep every field you send in the signed payload,
nullvalues included; - send the digest as lowercase hex, the way
HMAC-SHA256hex output comes out.
A signature computed over pretty-printed bytes will not match.
GET requests carry no body and require only Sdk-Partner-Token.
Successful responses and webhooks carry the same header: X-Signature holds the HMAC-SHA256 of the JSON data object, so you can verify authenticity. Error responses can arrive without it — an authentication failure is rejected before the signing key is resolved.
Credentials are issued per environment — see Sandbox & Testing.