Introduction
A pre-shared secret can be provided to verify API request authenticity use HMAC-SHA256
What is HMAC?
HMAC (Hash-based Message Authentication Code) uses a cryptographic hash function (SHA256 in our case) and a pre-shared secret to generate a signature. This signature ensures the integrity and authenticity of the message payload.
How the HMAC Signature is Generated
We hash the request payload using the SHA256 algorithm to generate a hex-encoded HMAC signature. This signature is included in the request header, as shown below:
You can then use a pre-shared secret as the key to verify that the request originated from us and that the payload was not altered.
x-server-authorization-hmac-sha256:
65060aeeee*********************eeebdad3196e9d7Obtaining HMAC Secret Key
One HMAC secret key can be provided per environment;
Staging (Testing Environment)
Prior to being certified, we sign requests using a temporary secret value, which may be either:
channelLink(present in most calls to partner endpoints)locationId(applicable to Dispatch API integrations and Get Products webhook for POS integrations)
Production (Live Environment)
Certified partners can generate their production HMAC secret via the Integration settings. Refer to the guide below for instructions;