How it works

The following describes steps, required to authenticate request signature using HMAC-SHA1:

1. You construct an API request (for API calls)

2. You calculate a keyed-hash message hmac code (HMAC-SHA512) signature using your API secret

3. You include both the API key in Authorization header and the signature in the HMAC header, and then call the API

4. The API uses your API key to look up your API secret

5. The API reconstructs the signature from the request data and the API secret with the same algorithm you used to calculate the signature you sent in the request

6. If the signature generated by Kriptopay matches the one you sent in the request, the request is considered authentic. If the comparison fails the request is discarded and Kriptopay returns 401 or 403 error responses:

401

{
    "success": false,
    "type": "client_error",
    "code": "authentication_failed",
    "error": "Invalid token."
}

403