Skip to main content

Authentication

MIDDLEWARE Authentication >> ANYMARKET (ANYMARKET APIs):​

For authentication with ANYMARKET APIs, the integrator must inform the following headers in the requests:

Headers
appIdIt is the unique identifier of the marketplace, provided by the ANYMARKET team.
tokenIt is the merchant identifier, provided by ANYMARKET to merchants.

ANYMARKET Authentication >> MIDDLEWARE (remotes):​

For authentication with Middleware, the technology used is JWT authentication (https://jwt.io/).

ANYMARKET will forward on all calls to the partner middleware, the header:

Headers
x-anymarket-tokenJWT with the information for authentication in the middleware.

JWT ANYMARKET example:

eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiJ9.eyJpcCI6IjEwLjAuOS4xNzIiLCJvcmdhbml6YXRpb24iOiJBTllNQVJLRVQgVGVzdGUgLSBCcmFzaWwiLCJvaSI6IjIyNDQ5NTA0LiIsImV4cCI6MTYxMjc5MTI2NCwibG9naW4iOiJkYW5pbG8ub2xpdmVpcmFAZGIxLmNvbS5iciJ9.FKF8wRb97xZmpakGbkoYfO0cjIkj48rwcis4DOGlUEh4cD98sFRJTVfrmMOaAe-XrBoPvTWbSdJfNy81-_VMLq9dbcKpBPO8MfHDXmqWV7tuHT1BaIcOkYZl-uIvOMtxCmDiCrX1ny2DvjY_LLuzRjexM6CQw4rRt8NXZb3dGV4

This JWT contains the following information:

"organization" - Company name
"oi" - Organization ID, merchant's unique identifier; This field differentiates the sellers
"exp" - Token expiration time
"login" - User making the call; Can be used for auditing purposes

The middleware must be prepared to receive the token, verify its expiration and identify the signature with the ANYMARKET public key.

Public key ANYMARKET​

MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDVfxWEym1WAYwGhrNjvEUWRgB+p9oUPGu59yePzUT+I/d+C2x9xjURa/Zc+VVZsK2OrHga1+4X4iO1q+nWhmXkD5VysCaJ9vf7IVntWogFpaBauG2EI7J93Y/sKUBxwxSDZPKhovsaM3DxoNCfW4lUHAWnlIuzPx302TBGtfCpUwIDAQAB

Recommendations​

The x-anymarket-token header has a jwt value that contains the "OI." (Organization Id/ Seller's identifier in ANYMARKET).

Knowing this, the middleware/marketplace must identify the seller by this value. It is common for marketplaces to ask the customer who will use the integration "oi." for the opening of the call and with that, when the calls to the middleware are triggered, it will have the information that the "OI." "X" corresponds to seller "Y" and will know that the seller has clearance or not to complete the calls.