# Authenticate Requests

Security in the Get Smart API Cloud is enforced through a digital signature included in every request and response. This guide explains how to generate this signature using your merchant key and how to verify the responses sent back by the server.

## The Signature Logic

The API does not use a standard Bearer token or Basic Auth. Instead, it uses a custom signature mechanism based on the **SHA256** hashing algorithm.

Every JSON message envelope contains two top-level fields:

1. `info`: The actual data payload.  
2. `signature`: The cryptographic hash verifying the `info` payload.

### The Algorithm

To generate a valid signature, follow this specific sequence:

1. **Extract Payload:** Take the entire content of the `info` JSON object.  
2. **Minimize JSON:** Ensure the JSON string is "minimized" (remove all extra whitespace, tabs, and newlines). It must start with `{` and end with `}`.  
3. **Append Secret:** Append your **merchant key** directly to the end of the minimized JSON string.  
4. **Hash:** Calculate the **SHA256** hash of this combined string.  
5. **Format:** The resulting hash (hexadecimal string) is your signature.

## Step-by-Step Example

Let's walk through the generation process using the sample data provided in the integration manual.

**Credentials:**

* **Merchant Code:** `777888991`  
* **Merchant key:** `AAABBB`

### Step 1: Construct the info Object

```
{
  "comercio": "777888991",
  "timestamp": "20250428 111217",
  "terminal": 1,
  "notificacion": {
    "urlNotificacion": "http://www.miservicio.es/servicio/notificaciones/tpvpc",
    "correoNotificacion": "email@comercio.es"
  },
  "datosOperacion": {
    "importe": "15.00",
    "factura": "FACTURA1"
  }
}
```

### Step 2: Minimize the JSON String

Serialize the object into a string with no spacing:

```
{"comercio":"777888991","timestamp":"20250428 111217","terminal":1,"notificacion":{"urlNotificacion":"http://www.miservicio.es/servicio/notificaciones/tpvpc","correoNotificacion":"email@comercio.es"},"datosOperacion":{"importe":"15.00","factura":"FACTURA1"}}
```

### Step 3: Append the Merchant Key

Add the key `AAABBB` to the end:

```
{"comercio":"777888991","timestamp":"20250428 111217","terminal":1,"notificacion":{"urlNotificacion":"http://www.miservicio.es/servicio/notificaciones/tpvpc","correoNotificacion":"email@comercio.es"},"datosOperacion":{"importe":"15.00","factura":"FACTURA1"}}AAABBB
```

### Step 4: Calculate SHA256 Hash

Running the string above through a SHA256 calculator yields: `0ED5D16230C0E2683CF304A713154B90D887D592EF72437AA214CBA305B00646`

### Step 5: Form the Final Request

Place the hash into the signature field:

```
{
  "info": {
    ... (the JSON object from Step 1) ...
  },
  "signature": "0ED5D16230C0E2683CF304A713154B90D887D592EF72437AA214CBA305B00646"
}
```

## Verifying Responses

When the API responds, it includes a `signature` calculated using the **same merchant key**. To verify the response is authentic and hasn't been tampered with:

1. Extract the `info` object from the response.  
2. Perform the exact same signature generation steps (Minimize \-\> Append Key \-\> Hash).  
3. Compare your calculated hash with the `signature` received in the response.

<Callout type="tip">

Always verify the response signature before trusting the status codes or transaction results inside the `info` block.

</Callout>

## Troubleshooting Signatures

The most common error is `TPC0101: Firma Incorrecta` (Incorrect Signature).

| Common Cause | Solution |
| :---- | :---- |
| **JSON Formatting** | Ensure you are hashing the *exact* string you are sending. Some JSON libraries add spaces or reorder keys. The signature is sensitive to specific byte-level representation. |
| **Character Encoding** | Ensure the string is encoded in **UTF-8** before hashing. |
| **Key Confusion** | Verify you are using the correct key for the environment (Test Key for Sandbox URL, Production Key for Live URL). |

## Next Steps

Now that you can authenticate, you are ready to explore the core architecture or implement specific payment flows.

* [**API Cloud Architecture**](/en/get-smart/get-smart-api-cloud/core-concepts/api-cloud-architecture): Understand the synchronous vs. asynchronous nature of the system.  
* [**Process Single-Step Payments**](/en/get-smart/get-smart-api-cloud/integration-guides/process-single-step-payments): Apply this signature logic to a real payment transaction.