topic Authentication Failed when Using Postman to Capture/Authorization Reversal in cybersource APIs

Authentication Failed when Using Postman to Capture/Authorization Reversal

ifs_merchant01 — Sat, 05 Jul 2025 01:53:38 GMT

Hi, I am developing integration and testing it with Postman using HTTP-Signature authentication.

I am able to Authorize Payment using developed PL/SQL function to create digest and signature. So I think logics to create those 2 string are good. In this case the request-target is '/pts/v2/payments'. Generated string then I used them in Postman in the header parameters.

When I tried to Reverse the authorization or Capture it the Authentication Failed. This is when {id} is used as the resource target. I think I may have passed the incorrect value to it. What is the correct way to create the signature string for these transactions?

Let's say my payload for capture is '{ "id": = "7516794640286053503814" }'

I generated signature string by passing:

'host: apitest.cybersource.com' || CHR(10) ||

'date: Fri, 04 Jul 2025 00:00:00 GMT' || CHR(10) ||

'resource-target: /pts/v2/payments/7516794640286053503814/captures' || CHR(10) ||

'digest: SHA-256=rh73kE3V/yd021ggwIYRjXYg6E8SUVAuKRQZr0M9VKo=' || CHR(10) ||

'v-c-merchant-id: ifs_merchant01'

Above generates signature: keyid="62366e4e-3a34-47a0-ad5a-a6b4b5641672", algorithm="HmacSHA256", headers="host date request-target digest v-c-merchant-id", signature="vlyVYVmp4AbMUuFrHJJjaUXi1c5hBKTD+ayDllxA7ic="

I have tried to use only '/pts/v2/payments', or with extra '/' at the end: '/pts/v2/payments/7516794640286053503814/captures/' all of them failed.

Any suggestions?

Re: Authentication Failed when Using Postman to Capture/Authorization Reversal

ifs_merchant01 — Sat, 05 Jul 2025 22:12:47 GMT

After I changed the field name 'date' to 'v-c-date' when generating signature I was able to generate signature string that match live console, headers="host v-c-date request-target digest v-c-merchant-id"

the header string to be hashed started with linefeed, Chr(10) in PLSQL or "/n" in C#. This is nowhere to be seen in documentation except when I looked in the C# source code.

After changing the field name 'date' to 'v-c-date' the HTTP Signature authentication went through and got response. My problem is solved.

Re: Authentication Failed when Using Postman to Capture/Authorization Reversal

joywalim — Wed, 23 Jul 2025 08:34:45 GMT

Authentication Failed in Postman usually means incorrect API keys tokens or credentials Double-check headers, authorization type, and endpoint.