Skip to main content
The Ebioro Merchant API uses HMAC Digest Authentication. Every request must include three headers that prove you own the API keys.

Required Headers

Computing the Signature

The signature is an HMAC-SHA256 hash of the concatenation of:
Where:
  • path — the request path including query string (e.g., /payments)
  • timestamp — the same value as X-Digest-Timestamp
  • method — HTTP method in uppercase (e.g., POST, GET)
  • body — the raw JSON body for POST requests, empty string for GET
Signed with your api_secret_key.

Code Examples

Timestamp Validation

The server rejects requests where the timestamp is more than 5 minutes from the server’s current time. Make sure your server clock is synchronized.

Errors