> For the complete documentation index, see [llms.txt](https://magicpay.gitbook.io/magicpay-documentation/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://magicpay.gitbook.io/magicpay-documentation/authentication.md).

# Authentication

## Authentication

Every request must have the following authentication headers in order to receive answer from the MagicPay API.

**Authentication Headers**

| Header         | Value                                                                                                              |
| -------------- | ------------------------------------------------------------------------------------------------------------------ |
| x-api-key      | Your MagicPay Api Key                                                                                              |
| x-rnd-key      | Custom generated random string value                                                                               |
| x-auth-version | The version number of the authentication algorithm. (V1 for now)                                                   |
| x-signature    | Signature created using the above parameters, secret access password and some information specific to the request. |

**Authentication Headers** Make sure to include these headers in the request:

1. `x_api_key`: Your API access key.
2. `x_rnd_key`: A random string generated for each request.
3. `x_auth_version`: The version number of the authentication method.
4. `x_signature`: The calculated digital signature.

**Signature Calculation** To calculate the signature:

1. **Concatenate the Following Components**:
   * **Raw URL**: The full request URL, including hostname, protocol, and query string.
   * **API Key**: Your unique API access key.
   * **Secret Key**: The private secret key associated with your account.
   * **Random String**: A randomly generated string created for this request.
2. **Create the Signature**:
   * Concatenate the above components into a single string.
   * Compute the SHA-256 hash of the concatenated string to generate a signature.
3. **Include the Signature**: Add this calculated signature in the `x_signature` header of your request.