SSSMS88 Merchant API Documentation
Table of Contents
Common Response Format
All API endpoints follow this standard response format:
| Field | Type | Description |
|---|---|---|
| status | integer | 1 for success, 0 for error |
| message | string | Response message indicating success or error details |
| data | array|object | Response payload. Empty array [] for errors, contains response data for success |
Authentication API
POST
https://{url}/api/apiAuthLogin
Description
This endpoint authenticates a merchant user and returns an authentication token upon successful login.
Request Parameters
| Parameter | Type | Required | Description |
|---|---|---|---|
| username | string | Yes | Merchant's username |
| password | string | Yes | Merchant's password |
| apiKey | string | Yes | Merchant's API key |
| signature | string | Yes | HMAC-SHA256 signature encoded in base64 |
Signature Generation
The signature is generated using the following steps:
- Create a string by concatenating parameters:
username={username}&password={password}&apiKey={apiKey} - Generate HMAC-SHA256 using the merchant's API secret as the key
- Encode the result in base64
Example Usage
$apiKey = 'YOUR_API_KEY';
$apiSecret = 'YOUR_API_SECRET';
$username = 'your_merchant_username';
$password = 'your_merchant_password';
// Generate signature
$signString = "username={$username}&password={$password}&apiKey={$apiKey}";
$signature = base64_encode(hash_hmac('sha256', $signString, $apiSecret, true));
$ch = curl_init('https://{url}/api/apiAuthLogin');
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, json_encode([
'username' => $username,
'password' => $password,
'apiKey' => $apiKey,
'signature' => $signature
]));
curl_setopt($ch, CURLOPT_HTTPHEADER, [
'Content-Type: application/json'
]);
$response = curl_exec($ch);
$result = json_decode($response, true);
if ($result['status'] === 1) {
$accessToken = $result['data']['accessToken'];
echo "Login successful! Token: " . $accessToken;
} else {
echo "Error: " . $result['message'];
}
import hmac
import hashlib
import base64
import requests
import json
api_key = 'YOUR_API_KEY'
api_secret = 'YOUR_API_SECRET'
username = 'your_merchant_username'
password = 'your_merchant_password'
# Generate signature
sign_string = f"username={username}&password={password}&apiKey={api_key}"
signature = base64.b64encode(
hmac.new(
api_secret.encode(),
sign_string.encode(),
hashlib.sha256
).digest()
).decode()
response = requests.post(
'https://{url}/api/apiAuthLogin',
headers={'Content-Type': 'application/json'},
json={
'username': username,
'password': password,
'apiKey': api_key,
'signature': signature
}
)
result = response.json()
if result['status'] == 1:
access_token = result['data']['accessToken']
print(f"Login successful! Token: {access_token}")
else:
print(f"Error: {result['message']}")
# Generate signature using OpenSSL
signature=$(echo -n "username=your_merchant_username&password=your_merchant_password&apiKey=YOUR_API_KEY" | \
openssl dgst -sha256 -hmac "YOUR_API_SECRET" -binary | base64)
# Make the API call
curl -X POST https://{url}/api/apiAuthLogin \
-H "Content-Type: application/json" \
-d '{
"username": "your_merchant_username",
"password": "your_merchant_password",
"apiKey": "YOUR_API_KEY",
"signature": "'$signature'"
}'
Response Fields
| Field | Type | Description |
|---|---|---|
| status | integer | 1 for success, 0 for error |
| message | string | Response message |
| data.accessToken | string | JWT token for authentication |
Response Examples
Successful Response
{
"status": 1,
"message": "Login successful",
"data": [
"accessToken": "1|4vY2W2KdFPUugYDDkdSBPXKHwGjKu6iMJTXq3Smxc7561ffe"
]
}
Invalid Signature Response
{
"status": 0,
"message": "Invalid signature",
"data": []
}
Invalid Credentials Response
{
"status": 0,
"message": "Invalid username / password",
"data": []
}
Using the Access Token
For subsequent API calls, include the access token in the Authorization header:
Authorization: Bearer 1|4vY2W2KdFPUugYDDkdSBPXKHwGjKu6iMJTXq3Smxc7561ffe