Verify merchant credentials

Verifies a merchant API token + HMAC-SHA256 signature. Called by the API Gateway auth interceptor on every request. Public clients do NOT call this endpoint directly — it is the canonical verification entrypoint. Returns the resolved `tenant_id` and `merchant_id` on success.

POST/api/v1/p2p/merchant/auth

Request Body

application/json

TypeScript Definitions

Use the request body type in TypeScript.

tenant_id?string

Tenant UUID (injected by the API Gateway from JWT claim).

Formatuuid

token?string

64-character hex public merchant token.

body?string

Raw request body used to recompute the signature.

signature?string

HMAC-SHA256 hex signature over body, keyed by webhook_secret.

Response Body

`application/json`

`application/problem+json`

curl -X POST "https://example.com/api/v1/p2p/merchant/auth" \  -H "Content-Type: application/json" \  -d '{}'

{  "tenant_id": "34f5c98e-f430-457b-a812-92637d0c6fd0",  "merchant_id": "500924a8-3f5e-4c00-beb8-2efcde988aea"}

{  "type": "../dictionary",  "title": "string",  "status": 0,  "detail": "string",  "instance": "../dictionary",  "errors": [    {      "field": "amount",      "message": "must be greater than 0",      "code": "POSITIVE_REQUIRED"    }  ]}

Verify merchant credentials

Request Body

Response Body

200application/json

401application/problem+json

`application/json`

`application/problem+json`