Introduction

The BAS SDK Payment API lets merchants initialize secure payment sessions, launch the BasGate client-side SDK, and reconcile transactions.

SandBox URL

https://mock.apidog.com/m1/1286474-1285155-1260791

All merchant endpoints require an OAuth 2.0 Bearer token obtained from the Authentication endpoint using the client_credentials grant type.

Tokens expire after expires_in seconds (default 3600). Refresh before expiry by calling the token endpoint again.

sandbox ClientID

sandbox2-f2a1-4a9b-81e3-0a3306e36d9a

sandbox client_secret

sandbox3-faed-44ff-b28a-4232d518e938

sandbox AppID

sandbox6-db74-4a3f-ba6f-46e6a5609fa4

sandbox MKey

MKeyTE0jbEFHNzVneVpVMQ==

Web page

https://bas-pay-sandbox.web.app/?language=ar&userIdentifier=770545398&fullName=Kamal&trxToken=xxxxxx

Test verification code

Every request to /merchant/sdk-payment/* endpoints must include a head object containing:

Field	Description
`signature`	HMAC-SHA256 (or AES-Rijndael) signature of the request payload using your merchant secret key.
`requestTimestamp`	Unix timestamp in milliseconds. Requests with significant clock skew are rejected to prevent replay attacks.

All responses share a common envelope:

{
  "status": 1,
  "code": "1111",
  "messages": ["Success"],
  "head": { "signature": "...", "requestTimestamp": "..." },
  "body": { }
}