To create and manage PAYONE Links we provide the following API.

Authorization

Authorization takes place via the Authorization header in the HTTP request and is subject to the following schema:

---end

Authorization header example 
Authorization: payone-hmac-sha256 VP35q2dC855VYEs0nzqTCbAx2BAUq1+oO1yByuvPcl4=

---end

Create/Update Link

Data Example View

merchantId

18333

accountId

18334

portalId

2111222

mode

test

reference

uniqueReference

totalAmount

100

currency

EUR

portalKey

superSecret

---end

The total amount is calculated as follows from the shopping cart:

shoppingCart 
"shoppingCart": [
{
    "type": "goods",
    "number": "article1",
    "price": 25,
    "quantity": 2,
    "vatRate": 7
},
{
    "type": "goods",
    "number": "article2",
    "price": 50,
    "quantity": 1,
    "vatRate": 7
}
]

---end

Total amount calculation 
article1.price * article1.quantity + article2.price * article2.quantity = totalAmount

---end

The token is now calculated in the following way:

Step 1: Concatenating the data
Concatenating principle 
merchantId + accountId + portalId + mode + reference + totalAmount + currency = dataToBeSigned

---end

Concatenating example 
18333 + 18334 + 2111222 + LIVE + uniqueReference + 100 + EUR = 18333183342111222LIVEuniqueReference100EUR

---end

Step 2: Signing with the portalKey
HmacSAH256 principle 
HmacSHA256(dataToBeSigned, portalKey) = signature

---end

HmacSHA256 example 
HmacSHA256(18333183342111222LIVEuniqueReference100EUR, superSecret) = signature

---end

Step 3: Base64 encoding
Base64 principle 
Base64(signature) = token

---end

Base64 example 
Base64(signature) = cBSvOHskJqf0Si/5ZP+mlM8lCm0zvT/YbH6MvvQWNBs=

---end

Finally we put the result in the header and get the request header:

Example header 
Authorization: payone-hmac-sha256 cBSvOHskJqf0Si/5ZP+mlM8lCm0zvT/YbH6MvvQWNBs=

---end

Request a single link

The principle remains the same the data to be signed is now: linkId

Example get single link 
Base64(HmacSHA256(linkId, portalKey))

---end

Request all links

The principle remains the same:

Get all links 
Base64(HmacSHA256(merchantId + accountId + portalId + mode, portalKey))