Overview

To authenticate B2B API requests, your should generate an HMAC signature and sends it with each B2B API request.

You will need three headers:

• X-B2B-Partner-Id: your partner identifier
• X-B2B-Api-Key: your public key
• X-B2B-Signature: HMAC signature of the signature payload

The signature is computed from:

1. A payload string derived from request body and URL parameters
2. A timestamp bucket (time window) used to prevent replay

What to sign

Signature payload format

<payload_string>|<signature_timestamp>

Where:

• payload_string is either an empty string, or a JSON string of the merged request parameters.
• signature_timestamp is an integer time bucket: ceil(currentTimeMs / 10_000).

How to build payload_string

1. Start with an empty object payloadObj.
2. If there is a request body, shallow-merge it into payloadObj.