Authentication

Authorization Header

The header must be present on every request and follow this exact format:

Authorization: HMAC-SHA256 Credential="<api_key>",Date="<datetime>",Signature="<signature>"

PARAMETER	DESCRIPTION
Credential	Your API key (the key value issued to you)
Date	Request timestamp in UTC, formatted as YYYYMMDDTHHmmssZ — e.g. 20260614T120000Z
Signature	HMAC-SHA256 signature over the canonical payload (see below)

⚠️
The request timestamp must not differ from the server clock by more than 5 minutes (300 seconds). Requests outside this window are rejected with 401 Request date expired.

The signature is a HMAC-SHA256 digest computed over a canonical payload string, using your API secret as the key.

CANONICALPAYLOAD

Concatenate the following four values, each separated by a newline character ( \n ):

date — The same Date value used in the header
method — HTTP method in uppercase — e.g. GET, POST
path — Request path without the domain — e.g. api/v1/payment-defaults
body_hash — SHA-256 hex digest of the raw request body; use the hash of an empty string for requests with no body

{date}\n{method}\n{path}\n{sha256(body)}

$credential = 'your-api-key';
$secret     = 'your-api-secret';
$datetime   = gmdate('Ymd\THis\Z');  // e.g. "20260614T120000Z"
$method     = 'GET';
$path       = 'api/v1/payment-defaults';
$body       = json_encode(['foo' => 'bar']);

// 1. Build canonical payload
$payload = implode("\n", [
    $datetime,
    $method,
    $path,
    hash('sha256', $body),
]);

// 2. Compute HMAC-SHA256 signature
$signature = hash_hmac('sha256', $payload, $secret);

// 3. Build Authorization header
$authHeader = 'HMAC-SHA256 '
    . 'Credential="' . $credential . '",'
    . 'Date="'       . $datetime   . '",'
    . 'Signature="'  . $signature  . '"';

Authentication and authorisation failures return a JSON error response with one of the following status codes and messages:

Status	Message	Cause
401	`Authorization header missing or invalid`	Header absent, wrong scheme, or malformed format
401	`Invalid or missing date in Authorization header`	`Date` field is absent or does not match the expected format
401	`Request date expired`	Timestamp differs from server time by more than 5 minutes
401	`API key not found`	No key matching `Credential` exists
401	`API key is not valid`	Key exists but is expired or not yet active
401	`Invalid signature`	Computed signature does not match the provided value
401	`User not found`	No user account linked to this API key
403	`Account is closed`	The associated account has been deactivated
403	`User does not have API permissions`	The account exists but lacks API access rights