Skip to Content
docs
Authentication

Authentication

All Epoint API requests use a data + signature authentication mechanism. This ensures request integrity and authenticates the merchant.

How It Works

Every API request requires two POST parameters:

  • data — Base64-encoded JSON string containing the API parameters
  • signature — Base64-encoded SHA1 hash for request verification

Generating the data Parameter

  1. Create a JSON string with your API parameters:
Request Body
1{
2  "public_key": "i000000001",
3  "amount": "30.75",
4  "currency": "AZN",
5  "description": "test payment",
6  "order_id": "1"
7}
  1. Base64-encode the JSON string:
Encode & Sign
1data = base64_encode(json_string)

Result:

Encode & Sign
1eyJwdWJsaWNfa2V5IjoiaTAwMDAwMDAwMSIsImFtb3VudCI6IjMwLjc1IiwiY3VycmVuY3kiOiJBWk4iLCJkZXNjcmlwdGlvbiI6InRlc3QgcGF5bWVudCIsIm9yZGVyX2lkIjoiMSJ9

Generating the signature Parameter

  1. Concatenate: private_key + data + private_key
Encode & Sign
1sgn_string = d3hjsl38sd8kdfhbcea0be04eafde9e8e2bad2fb092d + eyJwdWJsaWN... + d3hjsl38sd8kdfhbcea0be04eafde9e8e2bad2fb092d
  1. Apply SHA1 hash and Base64-encode:
Encode & Sign
1signature = base64_encode(sha1(sgn_string, 1))

Result:

Encode & Sign
1a76GNudqblZtV8qF199hctA+cG0=

Sending the Request

Option 1: API Request (server-to-server)

PHP
1$postfields = http_build_query([
2  'data' => $data,
3  'signature' => $signature,
4]);
5

6$ch = curl_init();
7curl_setopt($ch, CURLOPT_URL, $url);
8curl_setopt($ch, CURLOPT_POSTFIELDS, $postfields);
9$server_output = curl_exec($ch);

Option 2: Form Redirect (checkout)

HTML
1<form method="POST" action="***" accept-charset="utf-8">
2  <input type="hidden" name="data" value="BASE64_ENCODED_DATA"/>
3  <input type="hidden" name="signature" value="SIGNATURE_VALUE"/>
4  <button type="submit">Pay Now</button>
5</form>

Response Trace ID

Every API response includes a trace_id field — a unique identifier for that specific request. When contacting Epoint support about a transaction issue, providing the trace_id allows our team to quickly locate and analyze the full request/response cycle in our logs.

Request Body
1{
2  "status": "success",
3  "transaction": "te_0000000001",
4  "trace_id": "a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6"
5}

The trace_id is also returned in the X-Request-ID response header.

PHP Example

PHP (Laravel)
1$payload = [
2  'public_key' => 'your_public_key',
3  'amount' => 30.75,
4  'currency' => 'AZN',
5  'description' => 'test payment',
6  'order_id' => '1',
7];
8

9$data = base64_encode(json_encode($payload));
10$private_key = 'your_private_key';
11$signature = base64_encode(sha1($private_key . $data . $private_key, 1));
API OverviewCallbacks