Skip to main content

Authentication

In order to authenticate to our API, your request must provide an X-Wsse header.

Please note thant an header can only be used once and must be re-generated on each request.

Authentication by a Merchant​

Your header will matches the following pattern:

X-Wsse: AuthToken MerchantAPILogin="{merchantLogin}", PasswordDigest="{digest}", Nonce="{b64nonce}", Created="{timestamp}"

Where:

  • merchantLogin is your API login, provided by SysPay, along with a shared passphrase
  • b64nonce is a base64-encoded random token (nonce) generated for each request
  • timestamp is the current unix timestamp
  • digest is a string generated from the nonce, the timestamp and the passphrase with the following algorithm:
BASE64(BINARY_SHA1(NONCE + TIMESTAMP + PASSPHRASE))

Example code (PHP)

<?php
function generateHeaders($login, $passphrase) {
  $nonce     = md5(rand(), true);
  $timestamp = time();
  $digest    = base64_encode(sha1($nonce . $timestamp . $passphrase, true));
  $b64nonce  = base64_encode($nonce);
  return sprintf('X-Wsse: AuthToken MerchantAPILogin="%s", PasswordDigest="%s", Nonce="%s", Created="%d"', $login, $digest, $b64nonce, $timestamp);
}

generateHeaders("mylogin", "mypassphrase");

You would expect the following output:

X-Wsse: AuthToken MerchantAPILogin="mylogin", PasswordDigest="pIHzLACUUUZjsDkugJZnWESHYFQ=", Nonce="Uc7+N/ygEmQAfOOvrYHOow==", Created="1369414302"

Authentication by a Partner sending requests on behalf of a Merchant​

If you are a partner and sending a request to our API on behalf of a merchant, then your request must include an X-Wsse header that matches the following pattern:

X-Wsse: AuthToken MerchantAPILogin="{merchantLogin}", PasswordDigest="{digest}", Nonce="{b64nonce}", Created="{timestamp}", PartnerLogin="{partnerLogin}", PartnerDigest="{partnerDigest}"

Where:

  • merchantLogin The Merchant API login, provided by SysPay, along with a shared passphrase
  • b64nonce is a base64-encoded random token (nonce) generated for each request
  • timestamp is the current unix timestamp
  • digest is a string generated from the nonce, the timestamp and the passphrase with the following algorithm:
BASE64(BINARY_SHA1(NONCE + TIMESTAMP + PASSPHRASE))
  • partnerLogin is Partner API login, provided by SysPay, along with a shared partnerPassphrase
  • partnerDigest is a string generated from the nonce, the timestamp and the partnerPassphrase with the following algorithm:
BASE64(BINARY_SHA1(NONCE + TIMESTAMP + PARTNER_PASSPHRASE))

Example code (PHP)

<?php

function generateHeaders($merchantLogin, $passphrase, $partnerLogin, $partnerPassphrase, $nonce = null, $timestamp = null) {
  $nonce         = null === $nonce ? md5(rand(), true) : $nonce;
  $timestamp     = null === $timestamp ? time() : $timestamp;
  $digest        = base64_encode(sha1($nonce . $timestamp . $passphrase, true));
  $partnerDigest = base64_encode(sha1($nonce . $timestamp . $partnerPassphrase, true));
  $b64nonce      = base64_encode($nonce);

  return sprintf('X-Wsse: AuthToken MerchantAPILogin="%s", PasswordDigest="%s", Nonce="%s", Created="%d", PartnerLogin="%s", PartnerDigest="%s"', $merchantLogin, $digest, $b64nonce, $timestamp, $partnerLogin, $partnerDigest);
}

generateHeaders("merchantLogin", "merchantPassphrase", "myPartnerLogin", "myPartnerPassphrase", null, "1400000000");

You would expect the following output:

X-Wsse: AuthToken MerchantAPILogin="merchantLogin", PasswordDigest="l34fbiN8TnMcOuMrNa+j5k7YSqQ=", Nonce="bXkgcmFuZG9tIG5vbmNl", Created="1400000000", PartnerLogin="myPartnerLogin", PartnerDigest="yxag0yx38DPpCDx1Pl8UZnmXANE="