Request Signing

All requests to the Afterpay API must be signed and have a valid signature passed in the X-Afterpay-Request-Signature header. To generate the signature:

1. Construct the following string: {path}\n{X-Afterpay-Request-Date}\n{body}

   • {path} is the remainder of the URL following the host, including the query string (if present)
   • {X-Afterpay-Request-Date} is an epoch timestamp set to the current time. No more than 60 seconds should elapse between this timestamp and the time the request is made
   • {body} is the body of the API request (this should be skipped if there is no request body)

2. Create an HMAC-SHA256 cryptographic hash where the text to hash is the string you created in step 1. The secret is the secret value associated with the API key being used to make the request.

Example Authentication Headers

{
    "method": "post",
    "url": "https://agencyapi.sandbox.afterpay.com/v1/onboardings/",
    "headers": {
        "X-Afterpay-Request-Signature": "asasGCZUvApDuo3sIA=",
        "X-Afterpay-Request-Date": 1706263066,
        "X-Afterpay-Request-Apikey": "AB***CD"
    }
}

Request Signing Code Example

var moment = require("moment")
var sharedSecret = pm.environment.get("agencySharedSecret");
var requestTimestamp = moment(new Date().toUTCString()).valueOf() / 1000;
var requestURI = pm.environment.values.substitute(pm.request.url, null, false).toString();
var formatMessage = requestURI + "\n" + requestTimestamp;
var hmac = "";
if (!pm.request.body.isEmpty()) {
  formatMessage = formatMessage + "\n" + pm.request.body;
}
var message = CryptoJS.enc.Utf8.parse(formatMessage);
var secretBytes = CryptoJS.enc.Utf8.parse(sharedSecret);
var signatureBytes = CryptoJS.HmacSHA256(message, secretBytes);
var hmac = CryptoJS.enc.Base64.stringify(signatureBytes);

val timestamp = (System.currentTimeMillis() / 1000).toString()
var message = "$url\n$timestamp"
payload?.let { message += "\n$it" }
val messageBytes = message.toByteArray(Charsets.UTF_8)
val secretBytes = config.getSharedSecret().toByteArray(Charsets.UTF_8)
val secretKeySpec = SecretKeySpec(secretBytes, "HmacSHA256")
val mac = Mac.getInstance("HmacSHA256")
mac.init(secretKeySpec)
val signatureBytes = mac.doFinal(messageBytes)
val hmac = Base64.getEncoder().encodeToString(signatureBytes)