Authentication

Each time you send a transaction to our REST API, you must authenticate your request. To do this, send the following parameters in the header of your request.

Card Present / Meet in the Cloud

For Card Present / Meet in the Cloud transactions an additional header is required which identifies the device that is initiating / processing the transaction.

Hosted Fields

For Hosted Fields you will receive a dedicated client-side API Key that must be included in the JavaScript library configuration.

Digital Wallets

For Apple Pay and Google Pay transactions two additional parameters must be included in the JavaScript library configuration.

Example

An example configuration for Hosted Fields when using Digital Wallets.

GlobalPayments.configure( {
   // Client-Side API Key
   X-GP-Api-Key : "QwAnDXXXXXXXXXXXXXXXXXXXXXXETHqV",
   // AuthTokenV2 with the account_credential encrypted inside the payload
   Authorization : "AuthToken {{authTokenV2}}",
   // Unique identifier for the Merchant 
   X-GP-Merchant-Key: "{{terminal-merchant-key}}" 
   X-GP-Environment : "test",
   enableAutocomplete: true
});

An AuthTokenV2 is a unique token that we use to verify requests to the REST API based on the JSON Web Token (JWT) standard, for more information see JWT. The token has a header.payload.signature format. In this guide, we’ll step through how to create each component, concatenate them and create the signature.

Header

Example Header

{
 "alg":"HS256",
 "typ":"JWT"
}

Payload

Example Payload

{
  "type":"AuthTokenV2",
  "region":"US",
  "account_credential":"8000000XXXXX:800XXXXX:xcviSXXXXXXXXXXXXXXXXXXXXXXXXXXX",
  "ts": 1521839766066
}

Signature

In order to create the Signature, follow these steps:

1. Encode the header and payload using base64.
2. Concatenate the header and payload with a full stop.
3. Hash the concatenated header and payload using HS256 and the API secret.

Example signature

HMACSHA256( base64UrlEncode(header) + "." + base64UrlEncode(payload), apiSecret)