ADOPAY Developer Platform

Appearance

Authentication ​

All API requests use request-level digital signature authentication. See Request Signing for Digest / Canonical String / ES256 details.

Credential Types ​

1. Merchant Credential ​

text
API Key / Signing Key
   ↓
merchantId = M10001
  • Scope: a single merchant
  • Can call Merchant API transaction endpoints for that merchant only

2. Partner Credential ​

text
API Key / Signing Key
   ↓
partnerId = P10001
   ↓
Allowed Merchants
├── M20001
├── M20002
└── M20003
  • Scope: a Partner and its authorized merchants
  • Must call merchant-scoped resources, for example:
http
POST /v1/merchants/M20001/payments

Authorization check:

text
Credential → partnerId=P10001
   ↓
Does P10001 own M20001?
   ├─ YES → proceed
   └─ NO  → 403 Forbidden

partnerId is derived from the credential. Clients should not pass “who I am” as a free-form body field.

Production signing rules

Header names, Digest rules and ES256 signing steps are defined in Request Signing.