# Segurança
How to make safe payment requests.
# Assinaturas
A assinatura deve usar SHA256 como função hash HMAC.
Cabeçalho | Tipo | Descrição |
---|---|---|
Content-Type | string | application/json; charset=UTF-8 |
AppId | string | Seu App ID na plataforma de payout |
Authorization | string | SHA256($sorted_params + $app_key) |
TIP
Encontre $AppId, $app_key no dashboard do comerciante.
# Método de assinatura
Ascendentemente, selecione os parâmetros de solicitação, veja os exemplos abaixo;
Concatenar sorted_params com app_key.
Use sha256(sorted_params + app_key) para obter a Authorization.
TIP
Ao classificar os parâmetros, tire os que não têm valor.
WARNING
As letras em Authorization precisam ser em minúsculas.
# Exemplo de código de assinatura
Java
PHP
GoLang
Python
package com.transfersmile.ts;
import java.nio.charset.StandardCharsets;
import java.security.MessageDigest;
import java.security.NoSuchAlgorithmException;
import java.util.Map;
import java.util.TreeMap;
public static String getSign(Map<String, String> params, String authKey) {
String param = sortParam(params) + authKey;
return sha256(param);
}
public static String sha256(String str) {
String encodeStr = "";
try {
MessageDigest digest = MessageDigest.getInstance("SHA-256");
byte[] encodedhash = digest.digest(str.getBytes(StandardCharsets.UTF_8));
encodeStr = bytesToHex(encodedhash);
} catch (NoSuchAlgorithmException e) {
throw new RuntimeException("algorithm not supported");
}
return encodeStr;
}
public static String sortParam(Map<String, String> params) {
try {
Map<String, String> map = new TreeMap<>(params);
StringBuilder sb = new StringBuilder();
for (String k : map.keySet()) {
String v = map.get(k);
if (v != null && v.length() > 0) {
sb.append(k).append("=").append(v).append("&");
}
}
if (sb.length() <= 0) {
return "";
}
return sb.subSequence(0, sb.length() - 1).toString();
} catch (Exception e) {
e.printStackTrace();
}
return "";
}
private static String bytesToHex(byte[] hash) {
StringBuilder hexString = new StringBuilder(2 * hash.length);
for (int i = 0; i < hash.length; i++) {
String hex = Integer.toHexString(0xff & hash[i]);
if (hex.length() == 1) {
hexString.append('0');
}
hexString.append(hex);
}
return hexString.toString();
}
# Exemplo de assinatura
Exemplo de solicitação:
{
"account_digit": "4",
"account_number": "1234567",
"account_type": "CHECKING",
"additional_remark": "1234567_test",
"amount": "10.00",
"bankcode": "001",
"branch": "0001",
"custom_code": "1234567",
"document_id": "50284414727",
"document_type": "CPF",
"fee": "merchant",
"name": "Test User Name",
"notify_url": "https://www.transfersmile.com",
"payout_currency": "BRL",
"source_currency": "BRL"
}
Parâmetro ordenado antes do hash:
account_digit=4&account_number=1234567&account_type=CHECKING&additional_remark=1234567_test&amount=10.00&bankcode=001&branch=0001&custom_code=1234567&document_id=50284414727&document_type=CPF&fee=merchant&name=Test User Name&notify_url=https://www.transfersmile.com&payout_currency=BRL&source_currency=BRL
Concatenar sorted_params com app_key (exemplo app key ABCDE) :
account_digit=4&account_number=1234567&account_type=CHECKING&additional_remark=1234567_test&amount=10.00&bankcode=001&branch=0001&custom_code=1234567&document_id=50284414727&document_type=CPF&fee=merchant&name=Test User Name&notify_url=https://www.transfersmile.com&payout_currency=BRL&source_currency=BRLABCDE
sha256 hash
b15f900705867ecc3f66088054c14a80f9f12b1fb31c82320c4cbfe181876abb