Appearance
Common definitions
Authentication
The hizi.io Server (Backend) authenticates calls from the operator server with HTTP request header fields.
The call sends the following HTTP request header fields.
| Header field | Description |
|---|---|
| X-H-AUTH-ID | Operator ID |
| X-H-AUTH-SIG | Signature of the payload. See Signing payloads. |
| X-H-TIMESTAMP | A timestamp in ISO_8601 format |
The operator server authenticates calls from the hizi.io Server (Backend) with HTTP request header fields.
The call sends the following HTTP request header fields.
| Header field | Description |
|---|---|
| X-H-AUTH-ID | Operator ID |
| X-H-AUTH-SIG | Signature of the payload. See Signing payloads. |
| X-H-TIMESTAMP | A timestamp in ISO_8601 format |
Signing payloads
You need a secret to sign requests. To get this secret, log in to the hizi.io backoffice with your credentials. The signature is a base 64 encoded sha256 HMAC digest of a defined set of request parameters. This method lets you share the secret without including it in the request. You must also provide a timestamp as a request header field. Include this timestamp in the signature. Concatenate the fields with a hash character (#) before you calculate the sha256 HMAC.
The request always sends the signature in the request header field X-H-AUTH-SIG. For an example implementation of signature creation, log in to the hizi.io backoffice and look at the sample code provided.