Authentication

All partner API traffic is served from https://partner-api.intasef.com— a dedicated gateway that verifies your request signature and forwards verified requests to Intasef's core platform. There is no other public entry point.

Required headers

Every request must include:

  • X-Intasef-Key-Id — your API key ID (sandbox or live)
  • X-Intasef-Timestamp — current Unix timestamp, in seconds
  • X-Intasef-Nonce — a random string, unique per request
  • X-Intasef-Signature — the HMAC-SHA256 signature described below

Computing the signature

Build the payload string by joining these five parts with a period, then compute a hex-encoded HMAC-SHA256 digest of it using your API secret:

{method}.{path}.{timestamp}.{nonce}.{body}

{method} is the HTTP method in uppercase (e.g. POST), {path} is the request path (e.g. /api/partner/v1/trades/), {body} is the exact raw request body (empty string for a GET).

Example

signature = hex(hmac_sha256(
  secret,
  method + "." + path + "." + timestamp + "." + nonce + "." + body
))
curl -X POST https://partner-api.intasef.com/api/partner/v1/trades/ \
  -H "X-Intasef-Key-Id: pk_live_abc123" \
  -H "X-Intasef-Timestamp: 1731600000" \
  -H "X-Intasef-Nonce: 7f3e9c2a" \
  -H "X-Intasef-Signature: <computed signature>" \
  -H "Content-Type: application/json" \
  -d '{"title": "Widget", "amount": "100.00", "seller_id": "...", "buyer_name": "Jane Buyer"}'

Replay protection

Your timestamp must be recent, and your nonce must not have been used before within that window — a captured request can't be replayed, since the nonce is part of the signed payload itself, so an attacker can't swap in a fresh nonce without knowing your secret.

Sandbox vs. live

You have a separate key pair for sandbox and live. Both sign requests the same way — sandbox requests simply route through dev-mode payment simulation on the backend, so you can test a full trade lifecycle safely.