Authentication

This area has been prepared so you can access basic information about the security and authentication steps required before starting the integration.

When communicating with MorPOS APIs Authentication with the SHA256 algorithm is mandatory. By following the steps below, you can include the authentication mechanism in your integration.

Base URL PROD: https://sale-gateway.morpara.com

Base URL Sandbox: https://finagopay-pf-api-gateway.prp.morpara.com

---

1) Headers

MorPOS Merchant Panel > Key Management > Key Recognition by accessing the screen ClientId and ClientSecret obtain your information.

This information should be sent within the header information of all API calls you make.

---

2) Request Sign

In any API call, the sign parameter that must be sent together with the request body is mandatory.

The Sign value is generated as follows:

• Fields in the Request body are taken

• Instead of writing them one under another they are concatenated as a string

• API Key is appended to the end

• Encrypted with SHA256

• Converted to Base64 format and converted to uppercase

• This generated value sign is sent with the API request in the field

var CryptoJS = require("crypto-js");

let now = new Date();
let xTimestamp =
    now.getFullYear().toString() +
    String(now.getMonth() + 1).padStart(2, '0') +
    String(now.getDate()).padStart(2, '0') +
    String(now.getHours()).padStart(2, '0') +
    String(now.getMinutes()).padStart(2, '0') +
    String(now.getSeconds()).padStart(2, '0');

pm.environment.set("xTimestamp", xTimestamp);

const MrpApikey = "api_key_bilginiz";
const clientSecretKey = "client_secret_key_bilginiz";
const clientId = "client_id_bilginiz";
const MrpMerchantId = "merchant_id_bilginiz";

function generateRandomId(prefix, length) {
    const randomPart = Array(length)
        .fill(0)
        .map(() => Math.floor(Math.random() * 10))
        .join("");
    return `${prefix}${randomPart}`;
}

/*
ConversationId Rules

This field is mandatory; null or empty values are not accepted.
The value length must be exactly 20 characters.
Only English alphabetic characters (A-Z, a-z) and numeric characters (0-9) may be used.
Turkish characters (ç, ğ, ı, İ, ö, ş, ü) are not allowed.
*/

const conversationId = generateRandomId("MSD", 17); 
const conversationIdPayment = generateRandomId("YSD", 17);


console.log("Client Secret",clientSecretKey);

const decodedClientSecret = CryptoJS.enc.Base64.parse(clientSecretKey).toString(CryptoJS.enc.Utf8);

console.log("Decoded Client Secret (UTF-8): ", decodedClientSecret);


const combined = decodedClientSecret + xTimestamp;
console.log("Combined Value (Decoded Client Secret + X-Timestamp): ", combined);


const sha256Hash = CryptoJS.SHA256(combined);
console.log("SHA256 Hash (Raw): ", sha256Hash.toString(CryptoJS.enc.Hex)); // 


const utf8Hash = CryptoJS.enc.Utf8.parse(sha256Hash.toString(CryptoJS.enc.Hex));
const finalEncoded = CryptoJS.enc.Base64.stringify(utf8Hash);
console.log("Final Encoded Hash (Base64, UTF-8): ", finalEncoded);


pm.variables.set("EncodedHash", finalEncoded);
pm.variables.set("MpConversationId", conversationId);
pm.variables.set("MpConversationIdPayment", conversationIdPayment);

let requestBodyDump = JSON.parse(pm.request.body);


const requestBody = {
...
};

function isNullOrWhiteSpace(str) {
    return !str || str.trim().length === 0;
}

function calculateDynamicHash(requestBody) {
    const concatenatedString = Object.values(requestBody)
        .map((value) => `${value}`) 
        .join(";"); 

    if (isNullOrWhiteSpace(concatenatedString))
        return false;

    const hash = CryptoJS.enc.Base64.stringify(CryptoJS.SHA256(CryptoJS.enc.Utf8.parse(concatenatedString))).toUpperCase();

    return hash;
}

const hashResult = calculateDynamicHash(requestBody);
    pm.variables.set("MpSign", hashResult);