API Call Signature
When you register as a merchant, you should receive two key config values:
- Merchant Identifier, a string representing who you are
- Merchant Secret, a string used for API call signature encryption
TIP
Please keep Merchant Secret in a secured place.
Unified Signature Parameters
For both GET and POST requests, we share the same signature method：
- Append mid (Merchant Identifier), ts (Timestamp) to parameter list
- For GET Method: Sort all parameter by key in alphabetical order, Concat all parameters like
{"<key1>":"<value1>","<key2>":"<value2>"}as formal JSON style, then append mid (Merchant Identifier), ts (Timestamp) to sorted parameters like{"<key1>":"<value1>","<key2>":"<value2>"}{"mid":"m2","ts":"1693798918"} - For POST Method: Parameters do not need to be sorted , Append mid (Merchant Identifier), ts (Timestamp) to parameter body like
<post body>{"mid":"m2","ts":"1693798918"}
- Encrypt concat parameter string using SHA256 with the Merchant Secret as "sign"
- Append "mid", "ts" and "sign" onto request url in query string format (for both GET and POST method)
Detailed information about signature parameters:
| Name | Description |
|---|---|
| mid | Merchant Identifier |
| ts | Timestamp of API call happens. Precision: Seconds |
| sign | Signature Result Calculated from Input Parameters; Hash Algorithm: SHA256 |
Samples
GET Sample
| Name | Description |
|---|---|
| GET Curl | curl --request GET \--url '{Api Address}/game/list?mid=10001&ts=1693798918&sign=014d93d8c01ff3989f8c71fa22c6d32a7cf1f94918b3d65e3bbfb5413a64cf4e&page=1' |
| Mid | 10001 |
| Secret | r5VTsXcAC6IfwwqbAVYdu9dtmdApRj3f |
| Before Encrypt | {"page":"1"}{"mid":"10001","ts":"1693798918"} |
| After Encrypt (sign string) | e18c815b9a46ee745d67a0e33a8fab7635c37dc2bffc3977859b6dc8e257247c |
POST Sample
| Name | Description |
|---|---|
| POST Curl | curl --request POST \ --url '{Api Address}/game/start?mid=10001&ts=1693798918&sign=014d93d8c01ff3989f8c71fa22c6d32a7cf1f94918b3d65e3bbfb5413a64cf4e' \ --header 'content-type: application/json' \ --data '{"user_id":"64d9c2c9e339629378e5bd52","game_id":7,"currency":"MXN","lang":"en"}' |
| Mid | 10001 |
| Secret | r5VTsXcAC6IfwwqbAVYdu9dtmdApRj3f |
| Before Encrypt | {"user_id":"64d9c2c9e339629378e5bd52","game_id":7,"currency":"MXN","lang":"en"}{"mid":"10001","ts":"1693798918"} |
| After Encrypt (sign string) | c20f4c39b33e06ceb3309cff2bfd9787c0ee9adb10a36765b4ba63dd3df29cde |
|
Game Callbacks
After 2025-07-23, new merchants will add Content-type: application/json to the header.