Authentication

API_KEY="your-api-key"
SECRET_KEY="your-secret-key"
NONCE=$(uuidgen)
METHOD="GET"
REQUEST_PATH="/api/v1/client"

# Join with newlines (GET requests have no body line) and sign
STRING_TO_SIGN=$(printf '%s\n%s\n%s\n%s' "$API_KEY" "$METHOD" "$REQUEST_PATH" "$NONCE")
SIGNATURE=$(printf '%s' "$STRING_TO_SIGN" | openssl dgst -sha256 -hmac "$SECRET_KEY" -binary | base64)

curl -s -X GET \
  "https://www.api.external.test.mercury.global${REQUEST_PATH}" \
  -H "x-api-key: ${API_KEY}" \
  -H "x-nonce: ${NONCE}" \
  -H "Authorization: HMACSHA256 ${SIGNATURE}" \
  -H "Content-Type: application/json" | jq .

import base64, hashlib, hmac, uuid
import requests

API_KEY = "your-api-key"
SECRET_KEY = "your-secret-key"
BASE_URL = "https://www.api.external.test.mercury.global"

method = "GET"
path = "/api/v1/client"
nonce = str(uuid.uuid4())

# GET requests have no body line
string_to_sign = "\n".join([API_KEY, method, path, nonce])
signature = base64.b64encode(
    hmac.new(SECRET_KEY.encode(), string_to_sign.encode(), hashlib.sha256).digest()
).decode()

response = requests.get(
    f"{BASE_URL}{path}",
    headers={
        "x-api-key": API_KEY,
        "x-nonce": nonce,
        "Authorization": f"HMACSHA256 {signature}",
        "Content-Type": "application/json",
    },
)
print(response.json())

const crypto = require("crypto");

const API_KEY = "your-api-key";
const SECRET_KEY = "your-secret-key";
const BASE_URL = "https://www.api.external.test.mercury.global";

const method = "GET";
const path = "/api/v1/client";
const nonce = crypto.randomUUID();

// GET requests have no body line
const stringToSign = [API_KEY, method, path, nonce].join("\n");
const signature = crypto
  .createHmac("sha256", SECRET_KEY)
  .update(stringToSign, "utf8")
  .digest("base64");

fetch(`${BASE_URL}${path}`, {
  headers: {
    "x-api-key": API_KEY,
    "x-nonce": nonce,
    Authorization: `HMACSHA256 ${signature}`,
    "Content-Type": "application/json",
  },
})
  .then((res) => res.json())
  .then((data) => console.log(JSON.stringify(data, null, 2)));

import javax.crypto.Mac;
import javax.crypto.spec.SecretKeySpec;
import java.net.URI;
import java.net.http.*;
import java.nio.charset.StandardCharsets;
import java.util.Base64;
import java.util.UUID;

public class MercuryAuth {
    public static void main(String[] args) throws Exception {
        String apiKey = "your-api-key";
        String secretKey = "your-secret-key";
        String baseUrl = "https://www.api.external.test.mercury.global";

        String method = "GET";
        String path = "/api/v1/client";
        String nonce = UUID.randomUUID().toString();

        // GET requests have no body line
        String stringToSign = String.join("\n", apiKey, method, path, nonce);
        Mac mac = Mac.getInstance("HmacSHA256");
        mac.init(new SecretKeySpec(secretKey.getBytes(StandardCharsets.UTF_8), "HmacSHA256"));
        String signature = Base64.getEncoder()
            .encodeToString(mac.doFinal(stringToSign.getBytes(StandardCharsets.UTF_8)));

        HttpRequest request = HttpRequest.newBuilder()
            .uri(URI.create(baseUrl + path))
            .header("x-api-key", apiKey)
            .header("x-nonce", nonce)
            .header("Authorization", "HMACSHA256 " + signature)
            .header("Content-Type", "application/json")
            .GET().build();

        HttpResponse<String> response = HttpClient.newHttpClient()
            .send(request, HttpResponse.BodyHandlers.ofString());
        System.out.println(response.body());
    }
}

using System.Security.Cryptography;
using System.Text;

var apiKey = "your-api-key";
var secretKey = "your-secret-key";
var baseUrl = "https://www.api.external.test.mercury.global";

var method = "GET";
var path = "/api/v1/client";
var nonce = Guid.NewGuid().ToString();

// GET requests have no body line
var stringToSign = string.Join("\n", apiKey, method, path, nonce);
using var hmac = new HMACSHA256(Encoding.UTF8.GetBytes(secretKey));
var signature = Convert.ToBase64String(
    hmac.ComputeHash(Encoding.UTF8.GetBytes(stringToSign)));

using var client = new HttpClient();
client.DefaultRequestHeaders.Add("x-api-key", apiKey);
client.DefaultRequestHeaders.Add("x-nonce", nonce);
client.DefaultRequestHeaders.TryAddWithoutValidation("Authorization", $"HMACSHA256 {signature}");

var response = await client.GetAsync($"{baseUrl}{path}");
Console.WriteLine(await response.Content.ReadAsStringAsync());

METHOD="POST"
REQUEST_PATH="/api/v1/client"
# Abbreviated body to show signing. See the Client onboarding guide for every required field.
BODY='{"externalReference":"EXT-001","clientType":"Limited Company","riskRating":"Low","expectedMonthlySpend":5000}'
NONCE=$(uuidgen)

# The body sits between the path and the nonce
STRING_TO_SIGN=$(printf '%s\n%s\n%s\n%s\n%s' "$API_KEY" "$METHOD" "$REQUEST_PATH" "$BODY" "$NONCE")
SIGNATURE=$(printf '%s' "$STRING_TO_SIGN" | openssl dgst -sha256 -hmac "$SECRET_KEY" -binary | base64)

curl -s -X POST \
  "https://www.api.external.test.mercury.global${REQUEST_PATH}" \
  -H "x-api-key: ${API_KEY}" \
  -H "x-nonce: ${NONCE}" \
  -H "Authorization: HMACSHA256 ${SIGNATURE}" \
  -H "Content-Type: application/json" \
  -d "$BODY" | jq .

import json

method = "POST"
path = "/api/v1/client"
nonce = str(uuid.uuid4())
# Abbreviated body to show signing. See the Client onboarding guide for every required field.
body = json.dumps({
    "externalReference": "EXT-001",
    "clientType": "Limited Company",
    "riskRating": "Low",
    "expectedMonthlySpend": 5000
}, separators=(",", ":"))  # compact JSON, must match what you send

# The body sits between the path and the nonce
string_to_sign = "\n".join([API_KEY, method, path, body, nonce])
signature = base64.b64encode(
    hmac.new(SECRET_KEY.encode(), string_to_sign.encode(), hashlib.sha256).digest()
).decode()

response = requests.post(
    f"{BASE_URL}{path}",
    headers={
        "x-api-key": API_KEY,
        "x-nonce": nonce,
        "Authorization": f"HMACSHA256 {signature}",
        "Content-Type": "application/json",
    },
    data=body.encode("utf-8"),  # send the exact string you signed (not json=)
)