Authentication

ID Card Forgery v1 supports Basic Authentication and Bearer HMAC Authentication.

Basic Authentication

Send the merchant username and password through the HTTP Authorization header using the Basic scheme, and send the provisioned merchant key in the Merchant-Key header.

Code
Authorization: Basic <base64-encoded-credentials>
Merchant-Key: <merchant-key>
Content-Type: application/json

Bearer HMAC Authentication

Send the provisioned Bearer token in Authorization and include Timestamp and Signature. The signature is the Base64 representation of #client_id:#hmac_base64; calculate the HMAC-SHA256 input from timestamp:client_id:POST:body_md5_base64.

Code
Authorization: Bearer <access-token>
Timestamp: <unix-timestamp>
Signature: <base64-signature>
Content-Type: application/json

Keep credentials, merchant keys, tokens, and signing secrets in a secure server-side secret store. Do not expose them in browser or mobile application code.