How it works

The following describes the steps required to authenticate using HMAC-SHA1 request signature:

  1. You construct the API request to call the API

  2. You calculate a keyed-hash message authentication code (HMAC-SHA1) signature using your API secret

  3. You include both the API key and the signature in the Authorization header, and then call the API

  4. The API uses your API key to look up your API secret

  5. The API reconstructs the signature from the request data and the API secret with the same algorithm you used to calculate the signature you sent in the request

  6. If the signature generated by Cryptopay matches the one you sent in the request, the request is considered authentic. If the comparison fails the request is discarded and Cryptopay returns an error response:

401 Unauthorized: {
"error": {
"code":"unauthenticated",
"message":"unauthenticated",
"details"=>[]
},
"meta":null
}