Skip to main content

Authentication and Signature

merchantId is assumed to be present in all deployments, so signature is mandatory for every request.

Formula:

sign = Base64( SHA1_HEX_LOWER( dataBase64 + merchantId ) )

Where:

  • dataBase64 is the exact data parameter string.
  • merchantId is configured on Cashbox side.

Signature failures return error code = 1 (AUTH_ERROR).

Exceptions:

  • /supported_operations never requires data/sign at all — it accepts an empty body for backward-compatible discovery calls (see §6).
  • If merchantId is not configured on the device, signature verification is skipped entirely for every route — any sign value (including a missing one) is accepted. Do not rely on this for security; it exists only for deployments that haven't set up merchantId yet.