Autenticação

curl -X POST https://api.bspay.co/v2/oauth/token \
  -H "Authorization: Basic $(echo -n 'SEU_CLIENT_ID:SEU_CLIENT_SECRET' | base64)" \
  -H "Content-Type: application/json" \
  -d '{"grant_type": "client_credentials"}'

$credentials = base64_encode("{$clientId}:{$clientSecret}");

$ch = curl_init('https://api.bspay.co/v2/oauth/token');
curl_setopt_array($ch, [
    CURLOPT_POST => true,
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER => [
        "Authorization: Basic {$credentials}",
        "Content-Type: application/json",
    ],
    CURLOPT_POSTFIELDS => json_encode(['grant_type' => 'client_credentials']),
]);

$response = json_decode(curl_exec($ch), true);
$token = $response['access_token'];

const credentials = btoa(`${clientId}:${clientSecret}`);

const res = await fetch('https://api.bspay.co/v2/oauth/token', {
  method: 'POST',
  headers: {
    'Authorization': `Basic ${credentials}`,
    'Content-Type': 'application/json'
  },
  body: JSON.stringify({ grant_type: 'client_credentials' })
});

const { access_token: token } = await res.json();

import requests, base64

credentials = base64.b64encode(f"{client_id}:{client_secret}".encode()).decode()

res = requests.post(
    "https://api.bspay.co/v2/oauth/token",
    headers={
        "Authorization": f"Basic {credentials}",
        "Content-Type": "application/json",
    },
    json={"grant_type": "client_credentials"}
)
token = res.json()["access_token"]

{
  "access_token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...",
  "expires_in": 3600,
  "meta": {
    "request_id": "93e93fccf4e7413880bb4495",
    "timestamp": "2026-04-04T14:23:37Z"
  }
}

{
  "success": false,
  "error": {
    "code": "INVALID_CREDENTIALS",
    "message": "client_id ou client_secret inválidos.",
    "group": "AUTH",
    "retryable": false
  }
}

{
  "success": false,
  "error": {
    "code": "IP_BLOCKED_TEMPORARILY",
    "message": "Too many failed attempts. Try again in 5 minutes.",
    "group": "AUTH",
    "retryable": true
  }
}

$signingKey = $YOUR_SIGNING_KEY;
$body       = json_encode(['amount' => 50.00, 'currency' => 'BRL', /* ... */]);
$timestamp  = (string) time();
$nonce      = bin2hex(random_bytes(16));

$payload   = "{$timestamp}.{$nonce}.{$body}";
$signature = hash_hmac('sha256', $payload, $signingKey);

$ch = curl_init('https://api.bspay.co/v2/transactions/cashout');
curl_setopt_array($ch, [
    CURLOPT_POST => true,
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER => [
        "Authorization: Bearer {$token}",
        "Content-Type: application/json",
        "X-Signature: {$signature}",
        "X-Timestamp: {$timestamp}",
        "X-Nonce: {$nonce}",
    ],
    CURLOPT_POSTFIELDS => $body,
]);
$res = json_decode(curl_exec($ch), true);

import crypto from 'node:crypto';

const signingKey = process.env.BSPAY_SIGNING_KEY;
const body       = JSON.stringify({ amount: 50.00, currency: 'BRL' /* ... */ });
const timestamp  = Math.floor(Date.now() / 1000).toString();
const nonce      = crypto.randomUUID();

const payload   = `${timestamp}.${nonce}.${body}`;
const signature = crypto.createHmac('sha256', signingKey).update(payload).digest('hex');

const res = await fetch('https://api.bspay.co/v2/transactions/cashout', {
  method: 'POST',
  headers: {
    'Authorization': `Bearer ${token}`,
    'Content-Type': 'application/json',
    'X-Signature': signature,
    'X-Timestamp': timestamp,
    'X-Nonce': nonce,
  },
  body, // raw string — NÃO re-stringify
});

import hmac, hashlib, json, time, uuid, requests

signing_key = os.environ["BSPAY_SIGNING_KEY"]
body        = json.dumps({"amount": 50.00, "currency": "BRL"}, separators=(",", ":"))
timestamp   = str(int(time.time()))
nonce       = str(uuid.uuid4())

payload   = f"{timestamp}.{nonce}.{body}"
signature = hmac.new(signing_key.encode(), payload.encode(), hashlib.sha256).hexdigest()

res = requests.post(
    "https://api.bspay.co/v2/transactions/cashout",
    headers={
        "Authorization": f"Bearer {token}",
        "Content-Type": "application/json",
        "X-Signature": signature,
        "X-Timestamp": timestamp,
        "X-Nonce": nonce,
    },
    data=body,  # mesma string usada na assinatura
)

import (
    "crypto/hmac"
    "crypto/sha256"
    "encoding/hex"
    "fmt"
    "time"
)

body := []byte(`{"amount":50.00,"currency":"BRL"}`)
ts   := fmt.Sprintf("%d", time.Now().Unix())
nonce := uuid.NewString()

payload := []byte(ts + "." + nonce + "." + string(body))
mac := hmac.New(sha256.New, []byte(signingKey))
mac.Write(payload)
signature := hex.EncodeToString(mac.Sum(nil))