3 ms·
My suggestion would be as follows: 1. Partner registers a callback URL with you, gets an api_key and a shared secret in return. 2. When partner sends a user to
by bluesmoon 15y ago
My suggestion would be as follows:
1. Partner registers a callback URL with you, gets an api_key and a shared secret in return.
2. When partner sends a user to your site, they make a call to http://supportdetails.com/<api_key>?data=<random http://supportdetails.com/<api_key>?data=<random base64 string>
3. You collect details, and make a POST to the <callback_url> with all the information (including <random base64 string>) as JSON or XML and signed using a HMAC of the data with the shared secret
4. Partner verifies signature and then accepts the data. The <random base64 string> could contain information that the partner can use to identify the user/store session info, etc.
This protects your partners from fake submissions, if they care about that sort of thing.