Authorization Guide

All API interactions must utilize HTTPS with strict adherence to the following technical standards:

1. Content Handling

   • Content-Type: application/json (mandatory for all requests)
   • Character Encoding: UTF-8 exclusively

2. Common Request Parameters (HTTP Header)

Every API request must include these four essential parameters within the HTTP Header:

Step 1: Construct the string to participate in the signature calculation

The components are concatenated in the following order to form the string used for signature calculation:

url_without_query&Appid={Appid}&Authorization={accessToken}&Timestamp={Timestamp}&{sorted_query_parameters}&{request_body}&{AppSecret}

Query parameters must be handled separately from the URL:

1. Split the request URL into url_without_query and query parameters. The ? separator is not included in the signature string.
2. Decode each query parameter key and value, then sort the parameters by key in ascending lexicographical order.
3. Join the sorted parameters as key1=value1&key2=value2. Empty values must be retained as key=.
4. Append the sorted query parameters after Timestamp and before request_body, using & as the separator.
5. If the request has no query parameters, omit the query segment entirely.

Example 1: Request without Authorization Header, only for /v1/oauth/token endpoint (with request body)

url: https://open.mykeeta.com/api/open/grocery/v1/oauth/token
Appid: 123456
Timestamp: 1767196800
AppSecret: xyz
request body:
{
    "grantType": "client_credentials",
    "clientId": "123456",
    "clientSecret": "xyz"
}

The constructed signature calculation string is as follows:

https://open.mykeeta.com/api/open/grocery/v1/oauth/token&Appid=123456&Timestamp=1767196800&{"grantType":"client_credentials","clientId":"123456","clientSecret":"xyz"}&xyz

Example 2: HTTP GET request (without request body)

url: https://open.mykeeta.com/api/open/grocery/v1/order/chains/1297211/vendors/611469/orders?pageSize=50&page=1
Appid: 123456
Authorization: abcdef
Timestamp: 1767196800
AppSecret: xyz

The query parameters are sorted by key as follows:

page=1&pageSize=50

The constructed signature calculation string is as follows:

https://open.mykeeta.com/api/open/grocery/v1/order/chains/1297211/vendors/611469/orders&Appid=123456&Authorization=abcdef&Timestamp=1767196800&page=1&pageSize=50&xyz

Example 3: HTTP POST/PUT request (with request body)

url: https://open.mykeeta.com/api/open/grocery/v1/product/update/chains/1297211/vendors/61146
Appid: 123456
Authorization: abcdef
Timestamp: 1767196800
AppSecret: xyz
request body:
{
    "products": [
        {
            "sku": "TEST_SKU",
            "active": true,
            "price": 10,
            "quantity": 10,
            "baseWeight": 1,
            "baseWeightUnit": "kg",
            "pricePerBaseWeightUnit": 1
        }
    ]
}

The constructed signature calculation string is as follows:

https://open.mykeeta.com/api/open/grocery/v1/product/update/chains/1297211/vendors/61146&Appid=123456&Authorization=abcdef&Timestamp=1767196800&{"products":[{"sku":"TEST_SKU","active":true,"price":10,"quantity":10,"baseWeight":1,"baseWeightUnit":"kg","pricePerBaseWeightUnit":1}]}&xyz

Step 2: Calculate HMAC-SHA256 Signature

1. Use the constructed signature string in step 1
2. Use the provided AppSecret as key
3. Calculate HMAC-SHA256 hash
4. Encode the result in Base64 format

Step 3: Add the Signature to the Signature Header

Assign the generated signature to the Signature Header, and then submit the request.

Example:

"Signature": "1hk2Wb1l/3Hvpn8UrH8XjPG4/hSucZMuuzu5dYCt6E4="