Skip to main content

Authentication

API Key​

All V1 API requests require an API key sent in the X-API-Key header:

POST /v1/orders
X-API-Key: your-64-char-hex-api-key
Content-Type: application/json

You can also pass the key as a query parameter (not recommended for production):

GET /v1/orders?api_key=your-64-char-hex-api-key

Your API key is available in the merchant dashboard under Settings → API Credentials.

caution

Treat your API key like a password. Never expose it in client-side JavaScript or mobile app bundles. All API calls should be made from your server.

Request Signature (Optional)​

If you have configured a Webhook Secret in the dashboard, you can optionally sign write requests to add an extra layer of verification. This is not required unless your platform administrator has mandated it.

Algorithm: HMAC-SHA256 of the raw request body using your webhook_secret.

Header format:

X-Signature: sha256=<lowercase-hex-digest>

Generating the Signature​

PHP
$body = json_encode($payload);
$secret = 'your-webhook-secret';
$signature = 'sha256=' . hash_hmac('sha256', $body, $secret);

curl_setopt($ch, CURLOPT_HTTPHEADER, [
    'X-API-Key: ' . $apiKey,
    'X-Signature: ' . $signature,
    'Content-Type: application/json',
]);
Node.js
const crypto = require('crypto');

const body = JSON.stringify(payload);
const signature = 'sha256=' + crypto
  .createHmac('sha256', webhookSecret)
  .update(body)
  .digest('hex');

fetch('https://api.nusio-saka.com/v1/orders', {
  method: 'POST',
  headers: {
    'X-API-Key': apiKey,
    'X-Signature': signature,
    'Content-Type': 'application/json',
  },
  body,
});

Credential Rotation​

You can rotate your API key and secret from the merchant dashboard under Settings → API Credentials → Rotate. Old credentials are invalidated immediately, so ensure you update all integrations before rotating.