Webhook Authorization

To support a variety of use cases, the Webhook Processor supports the following authorization methods:

• OAuth
• Basic
• API Key
• HMAC

Each is described in the following sections.

OAuth

With OAuth, the Webhook processor will first retrieve a token from your Authorization Server.

Authorization Header:

Bearer <token>

The same token will be reused up until it gets close to its expiration time, at which point a new token will be retrieved.

Token Request

We support a number of authorization methods for the token request. Each is described in the following subsections. In all cases, we support adding parameters to the token request that are not related to authorization. The most common example would be scope. In the following request examples this is represented with param1=value1. Params are optional from our end, and are only needed if your authorization server requires them.

Client Credentials (Basic Authorization)

With this method, the client_id and client_secret are set in the Authorization Header.

Authorization Header:

Basic base64Encode(<client_id> : <client_secret>)

Request Body:

grant_type=client_credentials
&param1=value1

Client Credentials (Body Authorization)

With this method, the client_id and client_secret are set in the request body.

Request Body:

grant_type=client_credentials
&param1=value1
&client_id=<client_id>
&client_secret=<client_secret>

Client Credentials (JWT Bearer)

With this method, the rather than sending a client secret, the Webhook Processor generates a token and signs it with our private key. Your Authorization Server will need to validate the token using our public key.

Request Body:

grant_type=client_credentials
&param1=value1
&client_assertion_type=urn:ietf:params:oauth:client-assertion-type:jwt-bearer
&client_assertion=<assertion>

JWT Bearer

This method is very similar to Client Credentials (JWT Bearer), but is its own distinct grant type.

Request Body:

grant_type=urn:ietf:params:oauth:grant-type:jwt-bearer
&param1=value1
&assertion=<assertion>

Basic

With Basic Auth, you will need to provide POS Portal a username and password.

Authorization Header:

Basic base64Encode(<username> : <password>)

API Key

With API Key Auth, you will need to provide POS Portal an API Key.

Authorization Header:

Api-Key <apiKey>

HMAC

With HMAC Auth, you will need to provide POS Portal a shared secret. This will be used to hash the request body.

Authorization Header:

sha256 hmacSha256(<requestBody>)