Skip to content
OMPAYOMPAY API Documentation

API Authentication

  • The standard authentication for merchants uses the Authorization header with the Basic Authentication method. The Authorization header should contain a base64-encoded string consisting of the clientId and clientSecret in the format:
Authorization: Basic <base64-encoded-string>
  • The base64-encoded string is created by concatenating clientId and clientSecret with a colon in between, then encoding the concatenated string. For example, clientId:clientSecret is concatenated and then base64 encoded.

The following curl request shows how to send these headers in the API call.

Example Request:

Terminal window
curl -X POST '{{baseUrl}}/order' \
--header 'Authorization: Basic eW91ci1jbGllZW50LWlkOnlvdXItY2xpZW50LXNlY3JldC1rZXk=' \
--header 'Content-Type: application/json' \
--header 'X-Signature: <generated_signature>' \
--header 'X-MERCHANT-BROWSER-FINGERPRINT: 8357426ac73fcd60b17355ab7de60421' \
--header 'X-MERCHANT-USER-AGENT: <user-agent>' \
--header 'X-MERCHANT-DOMAIN: https://www.xyz.com' \
--header 'X-MERCHANT-IP: 123.123.123.123'

Steps to Obtain Credentials

Section titled “Steps to Obtain Credentials”
  • Log in to the OMPAY merchant dashboard to create your Client ID, Client Secret, and Card Encryption Key in the Merchant Hosted Checkout section of the dashboard.
  • The Client ID, Client Secret, and Card Encryption Key must all be securely updated in your website backend to authenticate API requests and ensure the security of card details.