API Keys & Authentication

📋 Prerequisites

Before integrating with our API, ensure you have:

• A Prestmit API sandbox account with API access enabled. You can get registered here → https://sandbox.prestmit.io
• You'll need to create an account and send an email to [email protected] requesting API access. Once your email has been received, our team will contact you with details about activating your access.
• Once API access is activated. You can get your API credentials from your dashboard

🔐 API Authentication System

Authentication Overview

Prestmit uses a multi-layered authentication approach.

Required Credentials

You'll need these credentials to authenticate with the API:

⚙️ Environments

You’ll get two environments:

• Sandbox: https://dev.prestmit.io/api/partners/v1
• Live: https://prestmit.io/api/partners/v1.

🔄 Authentication Flow Explained

The Prestmit API uses HMAC (Hash-based Message Authentication Code) to verify the authenticity and integrity of each request:

1. Create the payload: Your system combines your API key with the request body.
2. Generate the hash: An HMAC-SHA256 hash is created using your API secret key.
3. Add authentication headers: The hash and other required headers are included in your request.

This process ensures that:

• The request is coming from you (authentication)
• The request hasn't been tampered with (integrity)
• The request can't be replayed by attackers (with proper timestamp usage)

Authentication Headers

Every API request must include these headers:

💻 Generating the API-Hash Header

Every request to Prestmit’s API must include a valid API-Hash header. This header is a HMAC-SHA256 signature generated from your API credentials and request data.

1. What to Hash

When sending a request:

NOTICE: When making a POST request, ensure that you remove the attachments request parameter from the request body before generating the request hash.

1. Convert your request body (or query parameters, if it’s a GET request) to a JSON string.

2. Concatenate your API key and the stringified body using a colon (:):

   payload = API_KEY + ":" + JSON.stringify(body)

3. Generate an HMAC-SHA256 hash of that payload using your API secret key.

2. Code Examples

/**
 * Generate API-Hash for request authentication
 * 
 * Example: Creating a hash for Prestmit API requests
 * Language: JavaScript (Node.js)
 */

const CryptoJS = require('crypto-js');

const API_KEY = 'your_api_key_here';
const API_SECRET = 'your_api_secret_here';

// Example request body (replace with your own data)
// Remember to remove the 'attachments' field from the body.
const body = JSON.stringify({
  amount: 5000,
  currency: 'USD'
});

// Step 1: Create the payload
const payload = `${API_KEY}:${body}`;

// Step 2: Generate HMAC-SHA256 hash
const hash = CryptoJS.HmacSHA256(payload, API_SECRET).toString();

// Step 3: Add these headers to your request
console.log({
  'API-Key': API_KEY,
  'API-Hash': hash,
  'Content-Type': 'application/json'
});

<?php

// =============================================
//   Prestmit API Hash Generator - PHP Version
// =============================================

$API_KEY    = 'your_api_key_here';
$API_SECRET = 'your_api_secret_here';

// stringify the request body
$body = json_encode([
    'amount'   => 5000,
    'currency' => 'USD'
    // Do NOT include 'attachments' if present
]);

// Step 1: Create payload
$payload = $API_KEY . ':' . $body;

// Step 2: Generate HMAC-SHA256
$hash = hash_hmac('sha256', $payload, $API_SECRET);

// Step 3: Headers you should send
$headers = [
    'API-Key'       => $API_KEY,
    'API-Hash'      => $hash,
    'Content-Type'  => 'application/json'
];

// For debugging / testing
echo "Payload (for debugging only - don't send):\n";
echo $payload . "\n\n";

echo "Generated headers:\n";
print_r($headers);

echo "\nHash length: " . strlen($hash) . " characters\n";
// Should be exactly 64 characters

Example output:

{
  "API-Key": "abc12345",
  "API-Hash": "f3b2aefc9b5c90c65dd6e3e4787e99fba8f6d123456...",
  "Content-Type": "application/json"
}

3. Example Request

Content-Type:

POST: multipart/form-data
GET: application/json

POST /api/partners/v1/giftcard-trade/buy/calculate-payment HTTP/1.1
Host: api.prestmit.io
Accept: application/json
API-KEY: key_dev_xyzowllww....
Content-Length: 317
Content-Type: multipart/form-data; boundary=----WebKitFormBoundary7MA4YWxkTrZu0gW

------WebKitFormBoundary7MA4YWxkTrZu0gW
Content-Disposition: form-data; name="giftCardSKU"

922
------WebKitFormBoundary7MA4YWxkTrZu0gW
Content-Disposition: form-data; name="price"

5
------WebKitFormBoundary7MA4YWxkTrZu0gW
Content-Disposition: form-data; name="quantity"

1
------WebKitFormBoundary7MA4YWxkTrZu0gW--

GET /api/partners/v1/general/service-availability HTTP/1.1
Host: prestmit.test
Content-Type: application/json
Accept: application/json
API-KEY: key_dev_xyzowllww....

4. Server Verification (How It Works Behind the Scenes)

When your request reaches Prestmit:

1. The server reconstructs the same payload (API_KEY + ":" + body).

2. It generates a new HMAC using your stored secret.

3. It compares both hashes:

   • ✅ If they match → the request is authentic.
   • ❌ If not → the request is rejected (401 Unauthorized).

This ensures your request hasn’t been altered and that it truly originated from your account.

5. Quick Summary

⚠️ Important Notes

• Always use the exact same body content for hashing and sending the request. Even a minor difference in spaces or key order will cause authentication to fail.
• Use UTF-8 encoding when generating hashes.
• Never expose your API Secret Key publicly (e.g., in client-side code or browser).

🧪 Testing Your Authentication

Verification Endpoint

The simplest way to verify your authentication setup is working correctly is to use the service availability endpoint:

GET /general/service-availability

If your authentication is successful, you'll receive a response like:

{
    "buyGiftCard": true,
    "sellGiftCard": true,
    "nairaWalletWithdrawal": true,
    "cedisWalletWithdrawal": true
}

Common Authentication Errors

📚 Next Steps

Now that you understand our authentication system, you can:

• Set up webhooks for real-time notifications
• Learn how to sell gift cards through the API
• Learn how to buy gift cards through the API
• Learn how you can make money using Prestmit’s API