Authentication

import crypto from 'crypto';

function signedHeaders(accessId, accessSecret) {
  const requestId = crypto.randomUUID();
  const timeStamp = new Date().toISOString(); // e.g. 2026-10-15T09:45:53.123Z

  // Key order matters: timeStamp, requestId, accessId
  const message = JSON.stringify({ timeStamp, requestId, accessId });
  const signature = crypto
    .createHmac('sha256', accessSecret)
    .update(message)
    .digest('base64');

  return {
    'x-access-id': accessId,
    'x-request-id': requestId,
    'x-timestamp': timeStamp,
    'authorization': signature,
    'Content-Type': 'application/json',
  };
}

const accessId = process.env.TENDER_ACCESS_ID;
const accessSecret = process.env.TENDER_ACCESS_SECRET;

const response = await fetch('https://secureapi.tender.cash/v1/api/webhook', {
  method: 'POST',
  headers: signedHeaders(accessId, accessSecret),
  body: JSON.stringify({
    description: 'Production webhook',
    url: 'https://your-domain.com/webhooks/tender',
    eventTypes: ['transaction_completed'],
    headers: { 'X-Webhook-Secret': 'your-secret-value' },
  }),
});

console.log(response.status, await response.json());

import base64
import hashlib
import hmac
import json
import os
import uuid
from datetime import datetime, timezone

import requests


def signed_headers(access_id, access_secret):
    request_id = str(uuid.uuid4())
    # Millisecond UTC timestamp, e.g. 2026-10-15T09:45:53.123Z
    timestamp = (
        datetime.now(timezone.utc)
        .isoformat(timespec='milliseconds')
        .replace('+00:00', 'Z')
    )

    # Key order matters, and separators must have no spaces so the
    # string matches JavaScript's JSON.stringify output exactly.
    payload = {
        'timeStamp': timestamp,
        'requestId': request_id,
        'accessId': access_id,
    }
    message = json.dumps(payload, separators=(',', ':'))

    signature = base64.b64encode(
        hmac.new(
            access_secret.encode('utf-8'),
            message.encode('utf-8'),
            hashlib.sha256,
        ).digest()
    ).decode('utf-8')

    return {
        'x-access-id': access_id,
        'x-request-id': request_id,
        'x-timestamp': timestamp,
        'authorization': signature,
        'Content-Type': 'application/json',
    }


access_id = os.environ['TENDER_ACCESS_ID']
access_secret = os.environ['TENDER_ACCESS_SECRET']

response = requests.post(
    'https://secureapi.tender.cash/v1/api/webhook',
    headers=signed_headers(access_id, access_secret),
    json={
        'description': 'Production webhook',
        'url': 'https://your-domain.com/webhooks/tender',
        'eventTypes': ['transaction_completed'],
        'headers': {'X-Webhook-Secret': 'your-secret-value'},
    },
)

print(response.status_code, response.json())

<?php

function uuidV4() {
    $bytes = random_bytes(16);
    $bytes[6] = chr((ord($bytes[6]) & 0x0f) | 0x40);
    $bytes[8] = chr((ord($bytes[8]) & 0x3f) | 0x80);
    return vsprintf('%s%s-%s-%s-%s-%s%s%s', str_split(bin2hex($bytes), 4));
}

function signedHeaders($accessId, $accessSecret) {
    $requestId = uuidV4();
    // Millisecond UTC timestamp, e.g. 2026-10-15T09:45:53.123Z
    $timeStamp = (new DateTime('now', new DateTimeZone('UTC')))->format('Y-m-d\TH:i:s.v\Z');

    // Key order matters: timeStamp, requestId, accessId.
    // JSON_UNESCAPED_SLASHES keeps the string identical to JSON.stringify.
    $message = json_encode([
        'timeStamp' => $timeStamp,
        'requestId' => $requestId,
        'accessId' => $accessId,
    ], JSON_UNESCAPED_SLASHES | JSON_UNESCAPED_UNICODE);

    $signature = base64_encode(hash_hmac('sha256', $message, $accessSecret, true));

    return [
        'x-access-id: ' . $accessId,
        'x-request-id: ' . $requestId,
        'x-timestamp: ' . $timeStamp,
        'authorization: ' . $signature,
        'Content-Type: application/json',
    ];
}

$accessId = getenv('TENDER_ACCESS_ID');
$accessSecret = getenv('TENDER_ACCESS_SECRET');

$ch = curl_init('https://secureapi.tender.cash/v1/api/webhook');
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_HTTPHEADER, signedHeaders($accessId, $accessSecret));
curl_setopt($ch, CURLOPT_POSTFIELDS, json_encode([
    'description' => 'Production webhook',
    'url' => 'https://your-domain.com/webhooks/tender',
    'eventTypes' => ['transaction_completed'],
    'headers' => ['X-Webhook-Secret' => 'your-secret-value'],
]));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);

$response = curl_exec($ch);
$status = curl_getinfo($ch, CURLINFO_HTTP_CODE);
curl_close($ch);

echo $status . ' ' . $response;