Authentication and HMAC signing. Pick an SDK or integrate with cURL; all examples use the same HMAC authentication.
Authentication
The SDK generates headers on every request with the same rule as Postman. The signature is HMAC-SHA256(apiKey, timestamp + rawBody) as hex. For requests with a body (POST, PUT, PATCH, DELETE), rawBody must be the exact JSON sent, with keys sorted alphabetically.
| Header | Description |
|---|---|
| business-merchant-id | Merchant UUID |
| business-timestamp | Unix timestamp in seconds |
| business-signature | Hex HMAC signature of the body |
Security
Every request to /business/* carries three signed headers. The signed payload is timestamp + rawBody (no separator). In Postman: CryptoJS.HmacSHA256(payload, apiKey).toString(CryptoJS.enc.Hex).
stableStringify).business-signature.import { createHmac } from 'node:crypto';
import {
stableStringify,
signBusinessPayload,
buildBusinessAuthHeaders,
} from '@hanix.io/business';
const merchantId = process.env.HANIX_MERCHANT_ID!;
const apiKey = process.env.HANIX_API_KEY!;
const body = {
merchant_reference: 'orden-124',
amount_in_cents: 50000,
currency_id: process.env.HANIX_CURRENCY_ID!,
country_id: process.env.HANIX_COUNTRY_ID!,
description: 'opcional',
customer_email: 'opcional@email.com',
success_url: 'https://tu-tienda.com/ok',
cancel_url: 'https://tu-tienda.com/cancel',
expires_at: '2026-05-16T12:00:00.000Z',
metadata: { sku: 'ABC' },
};
// 1) JSON estable (claves ordenadas) — mismo bytes que el cuerpo HTTP
const rawBody = stableStringify(body);
// 2) Timestamp Unix en segundos (string)
const timestamp = String(Math.floor(Date.now() / 1000));
// 3) payload = timestamp + rawBody → HMAC-SHA256(apiKey, payload) en hex
const signature = signBusinessPayload(apiKey, timestamp, rawBody);
// Cabeceras (igual que el pre-request de Postman)
const headers = {
'Content-Type': 'application/json',
...buildBusinessAuthHeaders({ merchantId, apiKey, rawBody }),
};
// Manual: createHmac('sha256', apiKey).update(timestamp + rawBody, 'utf8').digest('hex')
await fetch(`https://api.hanix.io/api/v1/business/payment-orders`, {
method: 'POST',
headers,
body: rawBody,
});