Authentication

Phone Active v3 supports either Basic Authentication or Bearer HMAC Authentication.

Basic Authentication

Send the provisioned merchant username and password in the HTTP Authorization header and include the provisioned Merchant-Key header.

Bearer HMAC Authentication

Send the provisioned Bearer token in Authorization and include Timestamp and Signature. The signature is the Base64 representation of #client_id:#hmac_base64; calculate the HMAC-SHA256 input from timestamp:client_id:POST:body_md5_base64.

Never expose credentials or signing secrets in client-side applications.