Mizaniya Pay VTPE uses authentication in both directions. VTPE authenticates all requests it sends to your API and webhooks using your API Secret and an HMAC signature. You must verify these credentials on every incoming request to confirm it originates from VTPE.
API Secret
VTPE includes your API Secret in an Authorization header on every request it sends to your API and on every webhook. Use the same header when calling VTPE APIs from your system.
Timestamp
All requests between VTPE and your API include an X-Timestamp header with a Unix timestamp. This timestamp is used as part of the HMAC signature calculation for webhooks and helps prevent replay attacks on standard API requests.
HMAC Signature
VTPE signs every webhook request with an HMAC-SHA256 signature and includes it in the X-Signature header. The signature is computed by concatenating the raw request body with the timestamp string, then hashing with your HMAC Secret.
For detailed verification steps and code examples, see Webhook Security.
Verifying Incoming Requests from VTPE
When you receive any request from VTPE, perform the following checks in order:
- Check that the
Authorization header matches your API Secret exactly
- Check that the
X-Timestamp value is within an acceptable time window. We recommend rejecting timestamps older than 5 minutes or more than 5 minutes in the future
- For webhook POST requests, verify the
X-Signature header matches the HMAC signature you compute locally
Always reject requests with a missing or invalid Authorization header. Do not process the request if authentication fails.
Use a timestamp window of ±5 minutes to prevent replay attacks without being overly strict on minor clock skew.
