For AI agents: the complete documentation index is at /llms.txt, and the full text of every page is at /llms-full.txt. Most pages are also available as Markdown by adding .md to the URL.

Delay Pay - Authentication

Authenticate your loan requests.

Authenticating requests

Each time you send a transaction to the gateway, you must authenticate your request. To do this, send the following parameters in the HTTP header of your request:

Parameter	Description
Content-Type	Indicates the type of data that you are sending in the request. Send application/json.
Authorization	Secure JSON Web Token you include in the authorization header of your request, for example `"Authorization": "AuthToken {AuthTokenV2}"`. For more information about how to create an AuthToken, see Generating the AuthToken.
X-GP-Request-Id	GUID that you must generate for each request. The value for this parameter should have a prefix of `MER-`, for example `MER-XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXX`.
X-GP-Version	Version of the PayFields API that you use in your integration. For Hosted Fields, send `2021-04-08`. For Direct API, send `2021-12-09`.
X-GP-Api-Key	Your unique API key you use to send transaction requests.
X-GP-Partner-App-Name	Name of your application.

Generating the AuthToken

To create an AuthToken, you must have the following details:

Parameter	Description
account_credential	Credentials to identify your merchant.
API Secret	Unique API Secret we give you to generate your signature.

An AuthTokenV2 is a unique token that we use to verify requests to our gateway. When you send a request to our gateway, you must generate a unique AuthTokenV2 and send it in the header of your request along with your unique API Key. Because your POS uniquely generates each token based on your unique credentials, your requests are more secure. The AuthTokenV2 is based on the JSON Web Token (JWT) standard, for more information see JWT.

The AuthTokenV2 has a 'header.payload.signature' format. To create the token:

Create the header.
Create the payload.
Create the signature.

Header parameters for the AuthTokenV2

Parameter	Description
alg	Type of algorithm for the signature. Send `HS256`.
typ	Type of token you want to create. Send `JWT`.

{
 "alg":"HS256",
 "typ":"JWT"
}

Payload for the AuthTokenV2

Parameter	Description
type	Type of validation for the request. Send 'AuthTokenV2'.
region	Location of the request.
account_credential	Credentials we provide you for authenticating your requests. Note: For Apple Pay transactions, the account_credential must be encrypted.
ts	Timestamp in milliseconds.

Payload for US region

{
  "type":"AuthTokenV2",
  "region":"US",
  "account_credential":"8000000XXXXX:800XXXXX:xcviSXXXXXXXXXXXXXXXXXXXXXXXXXXX",
  "ts": 1521839766066
}

Payload for CA region

{
  "type":"AuthTokenV2 "
  "account_credential":"8000000XXXXX:800XXXXX:xcviSXXXXXXXXXXXXXXXXXXXXXXXXXXX",
  "region":"CA",
  "ts":"1521839766066"
}

Payload for UK region

{
  "type":"AuthTokenV2",
  "account_credential":"waXXXhI:f3XXXXXx1aKl:MR_8XX1f:TA_c6XXf4",
  "ts":"1521839766066"
}

Payload for NZ region

{
  "type":"AuthTokenV2",
  "account_credential":"fXXXX063-3Xx9-4XXb-9XX8-099X3x464xa6",
  "region":"NZ",
  "ts":"1521839766066"
}

Signature for the AuthTokenV2

Encode the header and payload using base64.
Concatenate the header and payload with a full stop.
Hash the concatenated header and payload using HS256 and the API secret.

Example signature

HMACSHA256( base64UrlEncode(header) + "." + base64UrlEncode(payload), apiSecret)

Policies

Connect

Additional Resources