axiron/Developers
⌘ K
Get API access
FOUNDATIONS / SECURITY

Authenticate with confidence.

Axiron uses a Bearer token to identify your integration and an HMAC-SHA256 signature to verify the request.

Your credentials#

Authorization

Send Bearer YOUR_TOKEN in the Authorization header. Keep credentials on your server.

signature

Use the lowercase signature header for the hexadecimal HMAC-SHA256 digest computed with your secret key.

Sign the exact payload#

  1. Serialize once

    Create a compact JSON body without additional spaces.

  2. Calculate the digest

    Use HMAC-SHA256 with your secret key and the serialized body.

  3. Send the same bytes

    Send that exact body with your token and signature. Changing the body after signing invalidates the signature.

GET requests have endpoint-specific signing

Follow the balance endpoint’s example for signing a GET request. Do not infer its signing input from POST requests. View the balance example →

If you receive 401#

Check the token, merchant activation, signature header and exact serialized payload. Never expose the secret key in browser code or logs.