Payment Open API (1.1.0)

We check the timestamp field(in seconds) in the request body or query parameters to validate the request. The timestamp must be within 10 minutes of the server's current time, or the request will be rejected. If it's a POST or PUT request, we get the timestamp from the request body. For the request of other methods, we get the timestamp from the query parameters.

For security reasons, we validate the IP address of the request against the partner's IP whitelist.

You are required to add the following headers to your request:

• x-qashier-partner: The partner ID provided by Qashier
• x-qashier-sign: The signature of the request payload

Signature Generation

Use crypto-js library to generate the signature if your language is JavaScript or TypeScript. For other languages, the implementation is similar. You can refer to the example below:

export const signRequestBody = ({
  rawString,
  hmacKey
}: {
  rawString: string;
  hmacKey: string;
}) => {
  const computedHash = CryptoJS.HmacSHA256(rawString, hmacKey);
  const computedHmac = CryptoJS.enc.Base64.stringify(computedHash);
  return computedHmac;
}; 

For POST or PUT Requests

The signature is computed from the raw request body.

The payload must be identical to the one used in the signature generation in order to ensure the signature is correct.

Example for a POST request:

const requestBody = { clientId: "client123", storeId: "store456", timestamp: 1702500000 };
const rawString = JSON.stringify(requestBody);
const signature = signRequestBody({ rawString, hmacKey: "your-secret-key" });

const response = await fetch('https://api.staging.qashier.com/v2/partner/qpay/initiate', {
  method: 'POST',
  headers: {
    'Content-Type': 'application/json',
    'x-qashier-partner': 'your-partner-id',
    'x-qashier-sign': signature
  },
  // payload must be identical to the one used in the signature generation
  body: rawString
});

For The Request of Other Methods

The signature is computed from the query parameters, sorted alphabetically by parameter name, and formatted as a query string without the leading '?'.

Example for a GET request with query parameters:

// For a request to /payment-method/list?clientId=client123&storeId=store456&timestamp=1702500000
const params = { clientId: "client123", storeId: "store456", timestamp: 1702500000 };

// Sort the keys alphabetically
const sortedKeys = Object.keys(params).sort();

// Create the raw string in the format key1=value1&key2=value2
const rawString = sortedKeys
  .map(key => `${key}=${params[key]}`)
  .join("&");
// Result: "clientId=client123&storeId=store456&timestamp=1702500000"

const signature = signRequestBody({ rawString, hmacKey: "your-secret-key" });

The API may return the following error responses: