Skip to main content

Documentation Index

Fetch the complete documentation index at: https://developers.ebioro.com/llms.txt

Use this file to discover all available pages before exploring further.

The Ebioro Merchant API uses HMAC Digest Authentication. Every request must include three headers that prove you own the API keys.

​
Required Headers

HeaderDescription
X-Digest-KeyYour public API key (pk_... or pk_test_...)
X-Digest-TimestampCurrent Unix timestamp (seconds)
X-Digest-SignatureHMAC-SHA256 signature of the request

​
Computing the Signature

The signature is an HMAC-SHA256 hash of the concatenation of: 
path + timestamp + method + body
Where:
  • path — the request path including query string (e.g., /payments)
  • timestamp — the same value as X-Digest-Timestamp
  • method — HTTP method in uppercase (e.g., POST, GET)
  • body — the raw JSON body for POST requests, empty string for GET
Signed with your api_secret_key.

​
Code Examples

const crypto = require('crypto');

function buildAuthHeaders(publicKey, secretKey, path, method, body = '') {
  const timestamp = Math.floor(Date.now() / 1000).toString();
  const data = method !== 'GET' ? JSON.stringify(body) : '';
  const toSign = path + timestamp + method + data;
  const signature = crypto
    .createHmac('sha256', secretKey)
    .update(toSign)
    .digest('hex');

  return {
    'X-Digest-Key': publicKey,
    'X-Digest-Timestamp': timestamp,
    'X-Digest-Signature': signature,
    'Content-Type': 'application/json',
  };
}

​
Timestamp Validation

The server rejects requests where the timestamp is more than 5 minutes from the server’s current time. Make sure your server clock is synchronized.

​
Errors

StatusReason
401Missing header values
401Invalid public key
401Signature verification failed
401The request timed out (timestamp too old)