Getnet DocsGetnet Docs

Authenticate Requests

View as MarkdownView this page as plain textOpen in ChatGPTAsk questions about this pageOpen in ClaudeAsk questions about this pageOpen in PerplexityAsk questions about this page
Connect to CursorUse these docs in CursorConnect to VS CodeUse these docs in VS Code

Security in the Get Smart API Cloud is enforced through a digital signature included in every request and response. This guide explains how to generate this signature using your merchant key and how to verify the responses sent back by the server.

The Signature Logic

The API does not use a standard Bearer token or Basic Auth. Instead, it uses a custom signature mechanism based on the SHA256 hashing algorithm.

Every JSON message envelope contains two top-level fields:

  1. info: The actual data payload.
  2. signature: The cryptographic hash verifying the info payload.

The Algorithm

To generate a valid signature, follow this specific sequence:

  1. Extract Payload: Take the entire content of the info JSON object.
  2. Minimize JSON: Ensure the JSON string is “minimized” (remove all extra whitespace, tabs, and newlines). It must start with { and end with }.
  3. Append Secret: Append your merchant key directly to the end of the minimized JSON string.
  4. Hash: Calculate the SHA256 hash of this combined string.
  5. Format: The resulting hash (hexadecimal string) is your signature.

Step-by-Step Example

Let’s walk through the generation process using the sample data provided in the integration manual.

Credentials:

  • Merchant Code: 777888991
  • Merchant key: AAABBB

Step 1: Construct the info Object

{
  "comercio": "777888991",
  "timestamp": "20250428 111217",
  "terminal": 1,
  "notificacion": {
    "urlNotificacion": "http://www.miservicio.es/servicio/notificaciones/tpvpc",
    "correoNotificacion": "[email protected]"
  },
  "datosOperacion": {
    "importe": "15.00",
    "factura": "FACTURA1"
  }
}

Step 2: Minimize the JSON String

Serialize the object into a string with no spacing:

{"comercio":"777888991","timestamp":"20250428 111217","terminal":1,"notificacion":{"urlNotificacion":"http://www.miservicio.es/servicio/notificaciones/tpvpc","correoNotificacion":"[email protected]"},"datosOperacion":{"importe":"15.00","factura":"FACTURA1"}}

Step 3: Append the Merchant Key

Add the key AAABBB to the end:

{"comercio":"777888991","timestamp":"20250428 111217","terminal":1,"notificacion":{"urlNotificacion":"http://www.miservicio.es/servicio/notificaciones/tpvpc","correoNotificacion":"[email protected]"},"datosOperacion":{"importe":"15.00","factura":"FACTURA1"}}AAABBB

Step 4: Calculate SHA256 Hash

Running the string above through a SHA256 calculator yields: 0ED5D16230C0E2683CF304A713154B90D887D592EF72437AA214CBA305B00646

Step 5: Form the Final Request

Place the hash into the signature field:

{
  "info": {
    ... (the JSON object from Step 1) ...
  },
  "signature": "0ED5D16230C0E2683CF304A713154B90D887D592EF72437AA214CBA305B00646"
}

Verifying Responses

When the API responds, it includes a signature calculated using the same merchant key. To verify the response is authentic and hasn’t been tampered with:

  1. Extract the info object from the response.
  2. Perform the exact same signature generation steps (Minimize -> Append Key -> Hash).
  3. Compare your calculated hash with the signature received in the response.

Always verify the response signature before trusting the status codes or transaction results inside the info block.

Troubleshooting Signatures

The most common error is TPC0101: Firma Incorrecta (Incorrect Signature).

Common CauseSolution
JSON FormattingEnsure you are hashing the exact string you are sending. Some JSON libraries add spaces or reorder keys. The signature is sensitive to specific byte-level representation.
Character EncodingEnsure the string is encoded in UTF-8 before hashing.
Key ConfusionVerify you are using the correct key for the environment (Test Key for Sandbox URL, Production Key for Live URL).

Next Steps

Now that you can authenticate, you are ready to explore the core architecture or implement specific payment flows.