> For the complete documentation index, see [llms.txt](https://docs.morpara.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.morpara.com/tr/en/integration-guide/quickstart.md).

# Authentication

 This area has been prepared so you can access basic information about the security and authentication steps required before starting the integration.

When communicating with MorPOS APIs **Authentication with the SHA256 algorithm** is mandatory. By following the steps below, you can include the authentication mechanism in your integration.

```
Base URL PROD: https://sale-gateway.morpara.com
```

```
Base URL Sandbox: https://finagopay-pf-api-gateway.prp.morpara.com
```

***

### 1) Headers

MorPOS Merchant Panel > **Key Management** > **Key Recognition** by accessing the screen\
`ClientId` and `ClientSecret` obtain your information.

This information should be sent within the **header** information of all API calls you make.

***

### 2) Request Sign

In any API call, the **sign** parameter that must be sent together with the request body is mandatory.

The Sign value is generated as follows:

* Fields in the Request body are taken
* Instead of writing them one under another **they are concatenated as a string**
* API Key is appended to the end
* Encrypted with SHA256
* Converted to Base64 format and converted to uppercase
* This generated value `sign` is sent with the API request in the field

```javascript
var CryptoJS = require("crypto-js");

let now = new Date();
let xTimestamp =
    now.getFullYear().toString() +
    String(now.getMonth() + 1).padStart(2, '0') +
    String(now.getDate()).padStart(2, '0') +
    String(now.getHours()).padStart(2, '0') +
    String(now.getMinutes()).padStart(2, '0') +
    String(now.getSeconds()).padStart(2, '0');

pm.environment.set("xTimestamp", xTimestamp);

const MrpApikey = "api_key_bilginiz";
const clientSecretKey = "client_secret_key_bilginiz";
const clientId = "client_id_bilginiz";
const MrpMerchantId = "merchant_id_bilginiz";

function generateRandomId(prefix, length) {
    const randomPart = Array(length)
        .fill(0)
        .map(() => Math.floor(Math.random() * 10))
        .join("");
    return `${prefix}${randomPart}`;
}

/*
ConversationId Rules

This field is mandatory; null or empty values are not accepted.
The value length must be exactly 20 characters.
Only English alphabetic characters (A-Z, a-z) and numeric characters (0-9) may be used.
Turkish characters (ç, ğ, ı, İ, ö, ş, ü) are not allowed.
*/

const conversationId = generateRandomId("MSD", 17); 
const conversationIdPayment = generateRandomId("YSD", 17);


console.log("Client Secret",clientSecretKey);

const decodedClientSecret = CryptoJS.enc.Base64.parse(clientSecretKey).toString(CryptoJS.enc.Utf8);

console.log("Decoded Client Secret (UTF-8): ", decodedClientSecret);


const combined = decodedClientSecret + xTimestamp;
console.log("Combined Value (Decoded Client Secret + X-Timestamp): ", combined);


const sha256Hash = CryptoJS.SHA256(combined);
console.log("SHA256 Hash (Raw): ", sha256Hash.toString(CryptoJS.enc.Hex)); // 


const utf8Hash = CryptoJS.enc.Utf8.parse(sha256Hash.toString(CryptoJS.enc.Hex));
const finalEncoded = CryptoJS.enc.Base64.stringify(utf8Hash);
console.log("Final Encoded Hash (Base64, UTF-8): ", finalEncoded);


pm.variables.set("EncodedHash", finalEncoded);
pm.variables.set("MpConversationId", conversationId);
pm.variables.set("MpConversationIdPayment", conversationIdPayment);

let requestBodyDump = JSON.parse(pm.request.body);


const requestBody = {
...
};

function isNullOrWhiteSpace(str) {
    return !str || str.trim().length === 0;
}

function calculateDynamicHash(requestBody) {
    const concatenatedString = Object.values(requestBody)
        .map((value) => `${value}`) 
        .join(";"); 

    if (isNullOrWhiteSpace(concatenatedString))
        return false;

    const hash = CryptoJS.enc.Base64.stringify(CryptoJS.SHA256(CryptoJS.enc.Utf8.parse(concatenatedString))).toUpperCase();

    return hash;
}

const hashResult = calculateDynamicHash(requestBody);
    pm.variables.set("MpSign", hashResult);



```