Authentication

When enrolled with OMPay, a set of client ID and secret credentials are provided together with your merchant ID.

TIP

Client ID and secret can be generated from your merchant dashboard. The merchant ID is provided to you upon creation of a business (Business specific)

Server-to-server

• Shell
• JavaScript

# Example header

curl https://API_endpoint_here \
  -H "Authorization: Basic <encoded string>" \ 

// Example header

curl https://API_endpoint_here \
  -H "Authorization: Basic <encoded string>" \ 

To initiate a request to any OMPay's endpoints from your server, the Authorization field of your HTTPS header must include an Basic Authentication scheme.

WARNING

Use HTTPS for all API requests, HTTP requests will not be successful.

Basic Authentication

The "Basic" HTTP authentication scheme is defined in RFC 7617 (opens new window), which transmits credentials as Client ID/Secret pairs, encoded using base64. For e.g :

1. Build a string of the <clientID>:<ClientSecret>
2. BASE64 encode the string.
3. Supply an Authorization header with content Basic followed by the encoded string

Client to OMPay server

Retrieve client token

POST: https://api.ompay.com/v1/merchants/YOUR_MERCHANT_ID/client_token

POST: https://api.sandbox.ompay.com/v1/merchants/YOUR_MERCHANT_ID/client_token

Request example

• Shell
• JavaScript

curl -X POST \
  https://api.ompay.com/v1/merchants/<merchantID>/client_token \
  -H 'authorization: Basic ODZidWQ0Y2JremlxOXZmYzoweHI1ZDkwOHo2bmo4a2h6' \
  -H 'content-type: application/json' \
  -d ''\''grant_type=client_credentials'\'''

var data = "'grant_type=client_credentials'";

var xhr = new XMLHttpRequest();
xhr.withCredentials = true;

xhr.addEventListener("readystatechange", function () {
  if (this.readyState === 4) {
    console.log(this.responseText);
  }
});

xhr.open("POST", "https://api.ompay.com/v1/merchants/<merchantID>/client_token");
xhr.setRequestHeader("authorization", "Basic ODZidWQ0Y2JremlxOXZmYzoweHI1ZDkwOHo2bmo4a2h6");
xhr.setRequestHeader("content-type", "application/json");

xhr.send(data);

Response example

{
    "accessToken": "<client_token>",
    "tokenType": "Bearer",
    "expiresOn": "2018-11-02T21:33:09Z",
    "issuedOn": "2018-11-01T21:33:09Z"
}

Together with every client side request, we need to send a client token. To retrieve this, you pass the Basic Authentication in the Authorization header of a get access token request.

In exchange of these credentials the OMPay server will issue a client token.

This sample request uses a bearer token to get payment nonce for a client:

• Shell
• JavaScript

curl -X POST \
  http://API_endpoint_here \
  -H 'authorization: Bearer <client_token>' \

var xhr = new XMLHttpRequest();
xhr.withCredentials = true;

xhr.addEventListener("readystatechange", function () {
  if (this.readyState === 4) {
    console.log(this.responseText);
  }
});

xhr.open("POST", "http://API_endpoint_here");
xhr.setRequestHeader("authorization", "Bearer <client_token>");

xhr.send(data);

Include this bearer token in API requests in the Authorization header with the Bearer authentication scheme.