Introduction

• In this documentation, the integrating party is called Merchant; ADOPAY is called Platform.
• In integration discussions, Cash In / Pix In are equivalent; Cash Out / Pix Out are equivalent.

Request examples

# Post请求示例
BODY='{"order_no":"A10001","amount":100,"currency":"CNY"}'

DIGEST=$(printf "%s" "$BODY" | openssl dgst -sha256 -binary | openssl base64)

TIMESTAMP=$(date +%s)
NONCE=$(openssl rand -hex 16)

SIGNING_STRING="(request-target): post /v1/orders
x-timestamp: ${TIMESTAMP}
x-nonce: ${NONCE}
digest: SHA-256=${DIGEST}"

SIGNATURE=$(printf "%s" "$SIGNING_STRING" | \
  openssl dgst -sha256 -sign merchant_private_key.pem | openssl base64)

curl -X POST https://api.example.com/v1/orders \
  -H "Content-Type: application/json" \
  -H "X-Merchant-Id: m123456" \
  -H "X-Timestamp: ${TIMESTAMP}" \
  -H "X-Nonce: ${NONCE}" \
  -H "Digest: SHA-256=${DIGEST}" \
  -H "Authorization: Signature keyId=\"m123456\",alg=\"ES256\",headers=\"(request-target) x-timestamp x-nonce digest\",signature=\"${SIGNATURE}\"" \
  -d "$BODY"

# Get请求示例
TIMESTAMP=$(date +%s)
NONCE=$(openssl rand -hex 16)

EMPTY_DIGEST=$(printf "" | openssl dgst -sha256 -binary | openssl base64)

SIGNING_STRING="(request-target): get /v1/orders?order_id=A10001
x-timestamp: ${TIMESTAMP}
x-nonce: ${NONCE}
digest: SHA-256=${EMPTY_DIGEST}"

SIGNATURE=$(printf "%s" "$SIGNING_STRING" | \
  openssl dgst -sha256 -sign merchant_private_key.pem | openssl base64)

curl -X GET "https://api.example.com/v1/orders?order_id=A10001" \
  -H "X-Merchant-Id: m123456" \
  -H "X-Timestamp: ${TIMESTAMP}" \
  -H "X-Nonce: ${NONCE}" \
  -H "Digest: SHA-256=${EMPTY_DIGEST}" \
  -H "Authorization: Signature keyId=\"m123456\",alg=\"ES256\",headers=\"(request-target) x-timestamp x-nonce digest\",signature=\"${SIGNATURE}\""

Common parameters

Location	Key	Val
Header	X-Merchant-Id	Merchant ID
Header	X-Timestamp	Unix timestamp (seconds)
Header	X-Nonce	Random string
Header	Digest	Request body digest
Header	Authorization	Signature