Аутентификация и подпись запросов (HMAC)

x-access-merchant-algorithm = "HMAC-SHA512"
message = base64url(normalized_payload) + str(timestamp)
x-access-signature = base64url(HMAC_SHA512(secret_key, message))

{
  "amount": 100,
  "status": "success",
  "is_paid": true,
  "data": {
    "id": 123,
    "is_active": false
  }
}

amount:100;data:id:123;data:is_active:0;is_paid:1;status:success

import base64
import json
import time
import hmac
import hashlib
import requests

url = "https://api.hh-processing.com/api/v1/payment/p2p/payin"

# Идентификатор кассы (UUID)
project_id = "57aff4db-b45d-42bf-bc5f-b7a499a01782"

# Секретный HMAC-ключ (строка)
secret_key = "<YOUR-HMAC-SECRET-KEY>"

payload = {
    "general": {
        "project_id": project_id
    }
}


def parse_json(prefix, obj, result):
    if isinstance(obj, dict):
        for key, value in obj.items():
            if isinstance(key, bool):
                key = int(key)
            new_prefix = f"{prefix}:{key}" if prefix else str(key)
            parse_json(new_prefix, value, result)
    elif isinstance(obj, list):
        for index, item in enumerate(obj):
            if isinstance(item, bool):
                item = int(item)
            new_prefix = f"{prefix}:{index}"
            parse_json(new_prefix, item, result)
    else:
        if isinstance(obj, bool):
            obj = int(obj)
        if obj is None:
            obj = ""
        result.append(f"{prefix}:{obj}")


def normalize_message(data: dict) -> str:
    items = []
    parse_json("", data, items)
    items.sort()
    return ";".join(items)


def masked_hmac_key(key: str, start_inx: int = 3, end_inx: int = 3) -> str:
    """
    Маскирование HMAC-ключа для безопасного логирования.
    """
    if not key or len(key) <= start_inx + end_inx:
        return "*******"
    return key[:start_inx] + "*******" + key[-end_inx:]


# Нормализация тела запроса
normalized = normalize_message(payload)

# Кодирование в Base64Url
encoded = base64.urlsafe_b64encode(normalized.encode("utf-8")).decode("utf-8")

# Метка времени Unix (секунды)
timestamp = int(time.time())

# Формирование сообщения для подписи
message = f"{encoded}{timestamp}".encode("utf-8")

# Вычисление HMAC-SHA512
signature_bytes = hmac.new(secret_key.encode("utf-8"), message, hashlib.sha512).digest()
signature_b64url = base64.urlsafe_b64encode(signature_bytes).decode("utf-8")

# Маска HMAC-ключа для x-access-token
hmac_mask = masked_hmac_key(secret_key)

# Формирование заголовков
headers = {
    "content-type": "application/json",
    "x-access-merchant-id": project_id,
    "x-access-timestamp": str(timestamp),
    "x-access-signature": signature_b64url,
    "x-access-merchant-algorithm": "HMAC-SHA512",
    "x-access-token": hmac_mask,
}

# Сериализация тела запроса (JSON)
dumped = json.dumps(payload, separators=(",", ":")) if payload else "{}"

response = requests.post(url, headers=headers, data=dumped)
print(response.status_code)