Loading...
Each time you send a transaction to the gateway, you must authenticate your request. To do this, send the following parameters in the HTTP header of your request:
| Parameter | Type | Required | Description |
|---|---|---|---|
| Authorization | String | Required | AuthTokenV2 to authenticate your request. Send in AuthToken {AuthTokenV2} format. For more information, see below for generating an AuthToken. |
| Content-Type | String | Required | Indicates the type of data that you are sending in your request. Send application/json. |
| X-GP-Api-Key | String | Required | Your unique API key. If you haven’t received your API key, contact our Integration Services team. |
| X-GP-Request-Id | String | Required | Version-4 UUID you generate to identify each request you send to our gateway. Add a prefix of MER- to your ID. For example: MER-ba96b9c5-828c-434c-be74-d73c8e853526. If you don’t send a value for this parameter, we generate a value with a prefix of API- and return it in the header of the response. |
| X-GP-Partner-App-Name | String | Required | Name of your application. |
| X-GP-Partner-App-Version | String | Required | Version of your application. |
| X-GP-Version | String | Required | Version of the API that you use in your integration. For running a sale and for running an independent refund, send 2021-04-08. For cancelling a transaction, send 2021-06-02. |
| X-GP-Target-Device | String | Required | Identifies the device sending the transaction in {Namespace}::{DeviceID} format. The value for namespace is one of the following; cedevice for Genius devices or rcm for Tetra Lane 3000 devices. |
To create an AuthToken, you must have the following details:
| Parameter | Description |
|---|---|
| account_credential | Credentials to identify your merchant. |
| API Secret | Unique API Secret we give you to generate your signature. |
An AuthTokenV2 is a unique token that we use to verify requests to our gateway. When you send a request to our gateway, you must generate a unique AuthTokenV2 and send it in the header of your request along with your unique API Key. Because your POS uniquely generates each token based on your unique credentials, your requests are more secure. The AuthTokenV2 is based on the JSON Web Token (JWT) standard, for more information see JWT.
The AuthTokenV2 has a 'header.payload.signature' format. To create the token:
| Parameter | Description |
|---|---|
| alg | Type of algorithm for the signature. Send HS256. |
| typ | Type of token you want to create. Send JWT. |
{
"alg":"HS256",
"typ":"JWT"
}| Parameter | Description |
|---|---|
| type | Type of validation for the request. Send 'AuthTokenV2'. |
| region | Location of the request. |
| account_credential | Credentials we provide you for authenticating your requests. Note: For Apple Pay transactions, the account_credential must be encrypted. |
| ts | Timestamp in milliseconds. |
{
"type":"AuthTokenV2",
"region":"US",
"account_credential":"8000000XXXXX:800XXXXX:xcviSXXXXXXXXXXXXXXXXXXXXXXXXXXX",
"ts": 1521839766066
}{
"type":"AuthTokenV2 "
"account_credential":"8000000XXXXX:800XXXXX:xcviSXXXXXXXXXXXXXXXXXXXXXXXXXXX",
"region":"CA",
"ts":"1521839766066"
}{
"type":"AuthTokenV2",
"account_credential":"waXXXhI:f3XXXXXx1aKl:MR_8XX1f:TA_c6XXf4",
"ts":"1521839766066"
}{
"type":"AuthTokenV2",
"account_credential":"fXXXX063-3Xx9-4XXb-9XX8-099X3x464xa6",
"region":"NZ",
"ts":"1521839766066"
}HMACSHA256( base64UrlEncode(header) + "." + base64UrlEncode(payload), apiSecret)