Authentication

All Merchant API requests must be authenticated using HTTP Basic Authentication.

Use your API Key as the username and your API Secret as the password. Every request to the Merchant API must include a valid Authorization header.

Note

Authentication is required for every Merchant API request.

HTTP Basic Authentication

Overdrive Connect uses HTTP Basic Authentication to identify your merchant account.

Authorization: Basic BASE64(API_KEY:API_SECRET)

Most HTTP client libraries automatically generate this header when provided with a username and password.

Example Request

The following example authenticates using an API Key and API Secret while creating a payment.

curl -X POST \
https://api.overdriveconnect.com/api/payments \
-u YOUR_API_KEY:YOUR_API_SECRET \
-H "Content-Type: application/json" \
-d '{
  "merchantPaymentReference": "ORDER-100001",
  "amount": 1000,
  "currency": "PHP"
}'

Authentication Failure

Requests with missing or invalid credentials receive a 401 Unauthorized response.

{
    "code": "INVALID_CREDENTIALS",
    "message": "Invalid credentials.",
    "requestId": "3c81a4e8-45d8-4c1f-96bb-79d3c7cf3bba"
}

Verify that your API Key and API Secret are correct and that the Authorization header is included with every request.

Security Recommendations

Store your API credentials securely.
Never expose your API Secret in browser or mobile applications.
Always communicate with the Merchant API over HTTPS.
Rotate your API credentials immediately if you suspect they have been compromised.

Important

API credentials identify your merchant account and should be protected with the same level of care as any other sensitive credential.

Next Step

Continue to the Error Handling guide to learn how Overdrive Connect reports validation, authentication, and processing errors.