\n
\n\n\nSecurity & Authentication
\n StartAuthentication
\nEncrypt or decrypt the cipher used in the StartAuthentication method. Choose between the current v2 flow (with timestamp) and the legacy v1 flow.
\n \n \n
\n\n \n \n
\n\n \n \n New authentication (v2) — Cipher plaintext:
\n\n TxId(36) = Random(17) + Timestamp(YYMMDDhhmm). Encrypted with AES-256-ECB using the last 32 chars of your token. Header: TransactionSignature: SHA256(TxId;SignKey).\n \n
\n\n \n\n 1Select Encrypt to generate a new cipher, or Decrypt to inspect an existing one.
\n 2Enter your token, token ID and sign key. Hover ? icons for field details.
\n 3Fill in the transaction details. Use Generate to create the GUID and random string.
\n 4Click Generate cipher + headers and copy the results.
\n \n \n \n
\n\n Encrypt cipher
Build cipher + headers
Decrypt cipher
Inspect existing cipher
\n
\n\n \n 1Token & credentials
\n \n
\n \n
\n \n
\n Full secret token from the Nayax portal (usually 66 chars). The last 32 characters are used as the AES-256 encryption key.
\n \n \n
\n Numeric ID of your token. Sent as the IntegratorId HTTP header with every request.
\n \n \n
\n 16-character secret shared by Nayax. Used to compute the TransactionSignature header: SHA256(SparkTransactionId;SignKey).
\n \n 2Transaction details
\n \n
\n \n \n
\n \n
\n Identifier of the Nayax terminal. Format depends on the Terminal ID Type selected.
\n \n \n
\n Type 1 = Hardware serial number. Type 2 = Nayax internal machine ID (MachineId).
\n \n \n
\n A UUID v4 generated by you for each transaction. Uniquely identifies this auth attempt. Format: xxxxxxxx-xxxx-4xxx-yxxx-xxxxxxxxxxxx.
\n \n \n
\n A random 17-character alphanumeric string you generate per request. Included in the cipher plaintext to prevent replay attacks.
\n \n Fill in all fields above, then click to encrypt and get your ready-to-send request body and headers.
\n \n\n
\n\n Legacy authentication (v1) — For existing integrations only. Cipher:
\n TxId(36)=Random(17) — no timestamp. Header: Signature: SHA256(minifiedJSON;HeaderHashKey).\n \n
\n \n 1Enter your token, integrator ID and header hash key from the Nayax portal.
\n 2Fill in the transaction fields and use Generate for the GUID and random string.
\n 3Click Build cipher + legacy signature to get the cipher, minified body and Signature header.
\n \n \n \n
\n Build cipher + signature
Legacy encrypt flow
Decrypt cipher
Inspect legacy cipher
\n
\n \n \n \n
\n \n \n \n
\n Your full secret token. Last 32 chars = AES-256 key.
Your numeric integrator ID. Sent as the IntegratorId HTTP header.
Legacy 16-char key for computing: Signature = SHA256(minifiedRequestBodyJSON;HeaderHashKey).
\n \n
\n \n \n \n \n
\n Numeric token ID. Included in the request body JSON.
The vending machine terminal identifier.
\n \n \n
\n 1 = Hardware serial. 2 = Nayax internal Machine ID.
UUID v4 generated by you. 36 chars including hyphens.
17-char random alphanumeric. Legacy cipher = TxId=Random (no timestamp).
Returns the cipher, minified request body, and Signature header value.
\n \n\n
\n\n\nSecurity & Authentication
\n StartSession
\nBuild or inspect the cipher for the StartSession callback. Nayax calls your endpoint — you respond with an encrypted cipher.
\n Flow: Nayax POSTs to your endpoint with HwSerial, MachineId, TokenId and a 27-char Random. You respond with a cipher:
\n TxId(36)=Random(27) → AES-256-ECB. No timestamp in StartSession cipher.\n \n
\n \n 1Nayax calls your endpoint. Enter the values they send (HwSerial, MachineId, TokenId, Random) in section 1.
\n 2In section 2, enter your secret token and generate a 36-digit transaction ID.
\n 3Click Generate StartSession cipher. Return the response body JSON to Nayax.
\n \n \n \n
\n Build response cipher
Respond to Nayax call
Decrypt cipher
Inspect StartSession cipher
\n
\n \n1Nayax sends you
\n \n
\n \n \n \n
\n Hardware serial number of the Nayax device, sent in the StartSession request.
Nayax internal numeric machine ID, sent in the StartSession call.
\n \n \n
\n Numeric token ID sent by Nayax so you know which key to use in your cipher response.
27-char random string sent by Nayax. Must appear in your cipher response: TxId=Random(27).
2Your response
\n \n \n \n
\n \n Your secret token for the TokenId Nayax sent. Last 32 chars = AES-256 key.
A 36-digit numeric ID you generate for this transaction. All digits, not a GUID. Included in your cipher and returned to Nayax.
Returns the Cipher and full JSON response body to send back to Nayax.
\n \n\n
\n\nSecurity & Authentication
\n Header Signature
\nCalculate the HTTP authentication headers for StartAuthentication requests. Choose between the current v2 TransactionSignature and the legacy v1 Signature flow.
\n\n \n \n
\n \n
\n Computes
\n TransactionSignature for New Auth (v2): SHA256(SparkTransactionId;SignKey)\n
\n \n 1Enter the Spark transaction ID (same GUID used in the request body) and your sign key.
\n 2Click Calculate headers to get the IntegratorId and TransactionSignature values.
\n \n \n
\n \n The same UUID v4 used in the request body. Signature = SHA256(this;SignKey).
\n \n \n
\n 16-char secret key from Nayax. Combined with TxId to produce the TransactionSignature header.
Your numeric integrator ID. Sent as the IntegratorId HTTP header.
Returns both HTTP headers ready to attach to your request.
\n \n\n
\nComputes
\n Signature for Legacy Auth (v1): SHA256(minifiedJSON;HeaderHashKey)\n
\n \n 1Paste the full request body JSON — it's minified automatically before hashing.
\n 2Enter the header hash key and integrator ID, then click Calculate legacy signature.
\n \n \n
\n \n Full request body you're sending. Auto-minified via JSON.stringify() before hashing. Must exactly match the HTTP body.
\n \n \n
\n 16-char key from Nayax for legacy auth. Used to compute: SHA256(minifiedBody;HeaderHashKey).
Your numeric integrator ID sent as IntegratorId HTTP header.
Returns the minified JSON and Signature header value.
\n \n