[
{
"title":"Testing",
"link":"https://docs.solidgate.com/payments/testing/",
"text":"Simulate payments to test your integration before launching in production.",
"imgSrc":"https://solidgate.com/wp-content/uploads/2022/06/icon-customizable.svg"
}
,
{
"title":"Create your payment form",
"link":"https://docs.solidgate.com/payments/integrate/payment-form/create-your-payment-form/",
"text":"Understand how to integrate the payment form into your product.",
"imgSrc":"https://solidgate.com/wp-content/uploads/2022/06/icon-payments.svg"
}
,
{
"title":"Subscriptions",
"link":"https://docs.solidgate.com/subscriptions/",
"text":"Create and maintain a stable and healthy business subscription model.",
"imgSrc":"https://solidgate.com/wp-content/uploads/2022/06/icon-global.svg"
}
]
Learn to authenticate API requests and fix validation errors effectively
By understanding the Solidgate validation and authentication process for API requests, you can gain access to the API and effectively handle validation error messages. Obtain the required credentials, including public and secret keys, and follow the signature creation and webhook validation steps to enable secure payment processing, proper authentication, and error management.
Retrieve your credentials
To start accepting payments, even in the sandbox environment, you require credentials. These credentials are Public
publicKey
and Secret
secretKey
keys, which should be applied for direct API calls and to check the webhook signature.
Obtain the keys from the personal account in the
Solidgate
HUB
by navigating to the Developers section and then proceeding to the specific Channel details page:
API keys have the prefix api_pk_/api_sk_
Webhook keys have the prefix wh_pk_/wh_sk_
The Public and Secret keys are applied to calculate the signature, verifying both the source and the integrity of the request details transmitted between the merchant and gateway.
Generate signature
The signature value is a base64-encoded string, which is a hexadecimal representation of the SHA-512 hash function. The encryption key utilized for this is the Secret key.
Use the string resulting from the concatenation to create a signature: publicKey + jsonString + publicKey
For
GET
requests that do not have a body, the signature data must simply be publicKey + publicKey
*Public and Secret keys, provided during merchant registration, are essential for generating secure signatures used in authentication and verification.
Use the generateSignature function, which takes the data and the Secret key as parameters.
Generate the HMAC-SHA512 hash using the Secret key and data.
Get the hexadecimal representation of the hash.
Encode the hexadecimal representation of the hash directly to Base64.
require'openssl'require'base64'defgenerate_signature(public_key,json_string,secret_key)digest=OpenSSL::Digest.new('sha512')instance=OpenSSL::HMAC.new(secret_key,digest)instance.update(public_key+json_string+public_key)Base64.strict_encode64(instance.hexdigest)end# Example usagepublic_key="api_pk_8f8a8k8e8k8e8y8"json_string='{"amount": "100", "currency": "USD"}'secret_key="api_sk_8f8a8k8e8k8e8y8"signature=generate_signature(public_key,json_string,secret_key)puts"Signature value: #{signature}"
Authenticate your API request
To authenticate, add the following headers to each request:
Header
Description
Example
merchant
A unique Public key is provided upon registration and must be shared for identification purposes.
api_pk_7b197……..ba108f842
signature
The request signature allows verification of the merchant’s authenticity on the payment gateway server.
MjNiYFdSdjVj……..hYmNiZDY=
Solidgate employs a similar
Guide
Subscribe for events on your Solidgate account so your integration can automatically trigger actions.
authentication method
for webhooks, using merchant and signature parameters in headers.
If you receive an incorrect signature response, verify your API keys and encryption value, then consult the Solidgate support team for further assistance.
Outgoing requests for IP addresses
Specific IP addresses are used for outbound requests to external services for secure and effective communication. Allowing traffic from these IP addresses in your system is crucial to ensure uninterrupted service and data exchange.
Configure your security systems to accept these IPs to prevent service interruptions.
Stay informed about any changes to these IP addresses for continuous service.
The Blocked by WAF error indicates that a Web Application Firewall (WAF) has prevented an API request due to a security and legal policy violation. This error often arises from mismatched endpoints and base URLs in API requests.
Ensure that the endpoint and base URL used in your API requests are correctly paired to avoid this error. Verify that the endpoint matches the intended action and conforms to the
Solidgate
API
reference.
Check the full URL
Confirm that the full URL used in your API request aligns with the valid endpoints provided in the
Solidgate
API
reference.
Verify endpoint-base URL pairing
Ensure that the endpoint corresponds to the appropriate base URL.
For example, if you attempt to cancel a subscription using the endpoint /subscription/cancel-by-customer at the base URL <https://pay.solidgate.com/api/v1>, you may encounter a Blocked by WAF error. The correct base URL for subscription actions should be <https://subscriptions.solidgate.com/api/v1>.
The WAF is configured to block IP addresses from sanctioned countries to increase security and ensure compliance with international regulations. To avoid this issue, ensure your IP address is not from a sanctioned country.