登录
登录
感谢您的访问。此页面目前仅提供英语版本。我们正在开发中文版本。谢谢您的理解。

Decrypting Credentials

Follow these steps to decrypt the encrypted credential payload. The result will be the plaintext credential payload.

NOTE: The steps below assume that the OpenSSL library is available for your platform. If that is not the case, the specific steps may vary, but the outcome should be the same.

If you set the parameter onboardingVersion to 2, then the payload will be returned in plaintext. To verify that the sender is Amazon however, please follow these steps:

  1. Next URLDecode the publicKeyId value from the payload.
  2. RSA-Decrypt the value obtained, making sure to specify the algorithm as RSA, using the private key.
  3. Base64decode the result and confirm that the value is what you expected.
  4. Continue to the How to process plaintext credentials section.

Otherwise, if you did not set the onboardingVersion parameter (or set it to 1), please follow the steps below to decrypt the encrypted response:

  1. First validate that the request came from Amazon Pay.
    1. Retrieve sigKeyId from the encrypted credential payload.
    2. Make a HEAD or GET request to https://payments.amazon.com/register/getpublickey , passing sigKeyId from Step a via the sigkey_id parameter. Example: https://payments.amazon.com/register/getpublickey?sigkey_id=sigKey82015

      Note: The example uses a North American payment region URL; please adjust as needed for your region.

    3. You will receive a public key in the response, which is used to validate the signature.
    4. Base64decode the signature from the encrypted credential payload.
    5. Use the verify function of the openSSL package (specifying the SHA256 algorithm), and pass in the result of 1d (base 64 decoded signature) and 1c (public key).
    6. Confirm that the verify command is successful.
  2. Next decrypt the encryptedKey value from the encrypted credential payload. This gives you the key that was used to encrypt the encryptedPayload value.
    1. Base64decode the encryptedKey value from the encrypted credential payload.
    2. Use the private decrypt function of the openSSL package (specifying the OPENSSL_PKCS1_OAEP_PADDING algorithm), to decrypt the result of 2a, passing in the private key that was generated on opening the workflow.
  3. Next decrypt the encryptedPayload using the result of 2b.
    1. Base64decode the encryptedPayload value from the original received request.
    2. Base64decode the iv value from the original received request.
    3. Use the mcrypt_cbc function of the mcrypt package to decode the result of 3a by specifying the MCRYPT_RIJNDAEL_128 algorithm and the result of 3b.

      NOTE: For a working example in PHP, view the decryptPayload function in our Magento extensions.
  4. Continue to the How to process plaintext credentials section.

Following the completion of these steps you will have the merchant credentials in a plaintext JSON object (see an example in the Payload data structures section).