Geidea Authentication

generated: '2026-07-12'
method: derived
source: docs.geidea.net (Pre-requisites, API reference) + openapi/geidea-openapi.yml
summary:
  types:
  - http
  - signature
schemes:
- name: basicAuth
  type: http
  scheme: basic
  description: >-
    HTTP Basic authentication. The merchant Public Key is the username and the API
    Password is the password, Base64-encoded into the standard Authorization header.
    Credentials are issued via the Geidea enablement team or the merchant portal
    under Payment Gateway -> Gateway Settings. The API Password is a secret and must
    never be exposed in a front-end; all Direct API calls must be made
    server-to-server.
  sources:
  - https://docs.geidea.net/docs/pre-requisites
  - openapi/geidea-openapi.yml
- name: hmacSignature
  type: signature
  scheme: HMAC-SHA256
  in: body
  fieldName: signature
  encoding: base64
  description: >-
    Requests additionally carry an HMAC request signature in the JSON body. The
    signature is an HMAC-SHA256 keyed by the API Password and Base64-encoded. For a
    Create Session request it is computed over a canonical concatenation of the
    merchant public key, amount, currency, merchant reference id, and timestamp; for
    merchant-initiated transactions it is computed over the merchant public key and
    session id. The exact canonical string per operation is documented in the Geidea
    API reference and should be confirmed before implementation.
  sources:
  - https://docs.geidea.net/docs/merchant-initiated-mit
  - https://docs.geidea.net/reference/create-session-v2-1
notes: >-
  Two mechanisms are used together: HTTP Basic auth carries the merchant identity
  and secret, and the per-request HMAC signature protects the integrity and
  authenticity of the payload. Base hosts are region-specific:
  api.ksamerchant.geidea.net (KSA), api.merchant.geidea.net (Egypt), and
  api.geidea.ae (UAE).
maintainers:
- FN: Kin Lane
  email: kin@apievangelist.com