Partner Access Token

The API uses an AES-256-ECB encrypted UTC timestamp to authenticate a channel partner and protect requests from replay attacks.

Credentials

You need the following values from the Channel Partner Profile:

1. API Key: public partner identifier.
2. Secret Key: private partner secret. Keep it secure and never expose it in client-side code.

Generate the Token in JavaScript

const crypto = require('crypto');

const apiKey = 'YOUR_PUBLIC_API_KEY';
const apiSecret = 'YOUR_PRIVATE_SECRET_KEY';
const timestamp = new Date().toISOString().replace('T', ' ').substring(0, 19);
const aesKey = apiSecret.substring(0, 32);

const cipher = crypto.createCipheriv('aes-256-ecb', aesKey, null);
cipher.setAutoPadding(true);

let encryptedTimestamp = cipher.update(timestamp, 'utf8', 'base64');
encryptedTimestamp += cipher.final('base64');

const token = Buffer.from(`${apiKey}|${encryptedTimestamp}`).toString('base64');

Generate the Token in PHP

<?php

$apiKey = 'YOUR_PUBLIC_API_KEY';
$apiSecret = 'YOUR_PRIVATE_SECRET_KEY';
$timestamp = gmdate('Y-m-d H:i:s');
$aesKey = substr($apiSecret, 0, 32);

$encryptedTimestamp = openssl_encrypt(
    $timestamp,
    'aes-256-ecb',
    $aesKey,
    0
);

$token = base64_encode($apiKey . '|' . $encryptedTimestamp);

Send the Header

Include a freshly generated token on every partner-protected request:

Partner-Access-Token: <token>

fetch('https://api.dev.onlynx.co.th/api/v1/auth/login', {
  method: 'POST',
  headers: {
    'Accept': 'application/json',
    'Content-Type': 'application/json',
    'Partner-Access-Token': token
  },
  body: JSON.stringify({
    credential: 'user@example.com',
    password: 'secret123'
  })
});

Validity Rules

• The encrypted timestamp must be UTC in YYYY-MM-DD HH:mm:ss format.
• The token expires five minutes after its timestamp.
• A future timestamp is allowed only within 60 seconds for clock drift.
• Generate the token on a trusted backend immediately before each API request.

Authentication Errors

Partner authentication failures return HTTP 401:

{
  "error": "Token has expired"
}

Possible messages include Invalid token format, Invalid token structure, Invalid API Key, Invalid token signature, Token has expired, Invalid timestamp, and Invalid timestamp format.