Authenticate Requests

Security in the Get Smart API Cloud is enforced through a digital signature included in every request and response. This guide explains how to generate this signature using your merchant key and how to verify the responses sent back by the server.

The Signature Logic

The API does not use a standard Bearer token or Basic Auth. Instead, it uses a custom signature mechanism based on the SHA256 hashing algorithm.

Every JSON message envelope contains two top-level fields:

1. info: The actual data payload.
2. signature: The cryptographic hash verifying the info payload.

The Algorithm

To generate a valid signature, follow this specific sequence:

1. Extract Payload: Take the entire content of the info JSON object.
2. Minimize JSON: Ensure the JSON string is “minimized” (remove all extra whitespace, tabs, and newlines). It must start with { and end with }.
3. Append Secret: Append your merchant key directly to the end of the minimized JSON string.
4. Hash: Calculate the SHA256 hash of this combined string.
5. Format: The resulting hash (hexadecimal string) is your signature.

Step-by-Step Example

Let’s walk through the generation process using the sample data provided in the integration manual.

Credentials:

• Merchant Code: 777888991
• Merchant key: AAABBB

Step 1: Construct the info Object

{
  "comercio": "777888991",
  "timestamp": "20250428 111217",
  "terminal": 1,
  "notificacion": {
    "urlNotificacion": "http://www.miservicio.es/servicio/notificaciones/tpvpc",
    "correoNotificacion": "email@comercio.es"
  },
  "datosOperacion": {
    "importe": "15.00",
    "factura": "FACTURA1"
  }
}

Step 2: Minimize the JSON String

Serialize the object into a string with no spacing:

{"comercio":"777888991","timestamp":"20250428 111217","terminal":1,"notificacion":{"urlNotificacion":"http://www.miservicio.es/servicio/notificaciones/tpvpc","correoNotificacion":"email@comercio.es"},"datosOperacion":{"importe":"15.00","factura":"FACTURA1"}}

Step 3: Append the Merchant Key

Add the key AAABBB to the end:

{"comercio":"777888991","timestamp":"20250428 111217","terminal":1,"notificacion":{"urlNotificacion":"http://www.miservicio.es/servicio/notificaciones/tpvpc","correoNotificacion":"email@comercio.es"},"datosOperacion":{"importe":"15.00","factura":"FACTURA1"}}AAABBB

Step 4: Calculate SHA256 Hash

Running the string above through a SHA256 calculator yields: 0ED5D16230C0E2683CF304A713154B90D887D592EF72437AA214CBA305B00646

Step 5: Form the Final Request

Place the hash into the signature field:

{
  "info": {
    ... (the JSON object from Step 1) ...
  },
  "signature": "0ED5D16230C0E2683CF304A713154B90D887D592EF72437AA214CBA305B00646"
}

Verifying Responses

When the API responds, it includes a signature calculated using the same merchant key. To verify the response is authentic and hasn’t been tampered with:

1. Extract the info object from the response.
2. Perform the exact same signature generation steps (Minimize -> Append Key -> Hash).
3. Compare your calculated hash with the signature received in the response.

Troubleshooting Signatures

The most common error is TPC0101: Firma Incorrecta (Incorrect Signature).

Next Steps

Now that you can authenticate, you are ready to explore the core architecture or implement specific payment flows.

• API Cloud Architecture: Understand the synchronous vs. asynchronous nature of the system.
• Process Single-Step Payments: Apply this signature logic to a real payment transaction.