Authentication

Authentication is simple and the same for every Kambia service.

👉 You will need your credentials.

The Kambia API has two environments and one public version (v1):

1. Development

https://sandbox.kambia.app/v1

2. Production

https://api.kambia.app/v1

To verify the authenticity and integrity of each request, send these 3 headers:

Header	Description
`x-merchant-key`	Your public key
`x-merchant-signature`	HMAC-SHA256 signature of the request
`x-merchant-timestamp`	Request timestamp (in milliseconds)

Build the string to sign

Concatenate these values, in this order:

Field	Description
`merchant_id`	Your unique identifier at Kambia
`JSON(body)`	Request body as JSON
`timestamp`	Request timestamp (in milliseconds)

The JSON must be compact (no spaces), with accented letters and ñ as they are, not escaped, just as JSON.stringify produces it.

Generate the HMAC-SHA256 signature

Use your private key merchant-secret to generate a hex-encoded HMAC SHA-256:

Here are 3 examples of how to generate the authentication headers:

JavaScript

Python

PHP

🤔 Questions?
Send a message to josue@kambia.app and I'll be glad to help.