Authentication

Requests are authenticated per POS terminal. Each terminal is issued an apiKey (a shared secret) when it is created. The secret is never transmitted, it only signs requests, which gives integrity and replay-attack protection.

A signed request carries two extra fields inside params:

• ts, Unix timestamp in milliseconds when the request was created.
• signature, hex-encoded HMAC of the request payload.

Computing the signature (client side):

1. Take the request params object and remove the signature field.
2. Sort the remaining entries by key (ascending) and serialize with JSON.stringify, this is the canonical message.
3. signature = HMAC-SHA256(key = terminal apiKey, message = canonical JSON), hex-encoded.

Validation (server side):

1. The server resolves the terminal, recomputes the HMAC and rejects the request unless it equals signature.
2. ts must be at most 60s in the future and no older than 5 minutes.