# API Security

## **Description**

Original Request data is encrypted by AES-128 and placed in “Request” field with JSON format. The AES key is encrypted by RSA public key and placed in “ApiKey” field with JSON format.

Encryption Process is as follows: -

![](https://3875509716-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-L_MjRKz_dUm_g2dT4fH%2F-L_QN91Ki2QY1ylessSC%2F-L_QcUg6z78PlKB-P8Mh%2Fimage7.png?alt=media\&token=5765082b-1d8a-4397-b76d-35edc54656af)

## **Creating AES-128 Key**

AES 128-bit encryption is required in data transmission and is created on the user side.

{% hint style="warning" %}
To ensure the data security, use a new AES Key for every transaction is recommended.
{% endhint %}

## **Encrypting the Request by AES-KEY**

AES encryption is required for data in JSON format.

{% hint style="info" %}
AES encryption adopts 128-bit key, CBC mode, and the IV is provided by intella.
{% endhint %}

## **Encrypting the AES-KEY by RSA Public Key**&#x20;

RSA Public Key is provided by intella.

## **Processing a Transaction Request**

The original request body, which is encrypted by AES and based64-encoded, is placed in the ‘Request’ field. The AES key, which is encrypted by RSA and based64-encoded, is placed in the ‘ApiKey’ field.

Sample:

```
{
    "Header":
    {
        "Method":"00000",
        "ServiceType":"OLPay",
        "MchId":"103543903790001",
        "TradeKey":"03ac674216f3e15c761ee1a5e255f067953623c8b388b4459e13f978d7c846f4",
        "CreateTime": "20180313120000"
    },
    "Data":"{\"TimeExpire\":\"201803121000\", \"StoreOrderNo\": \"skb0001\",\"Body\": \"Milk Tea\",\"TotalFee\":\ "35\",\"FeeType\": \"TWD\",\"Detail\": \"商品細節\",\"StoreInfo\": \"Intella0001\",\"Token\": \"QWERTYUIOPASDFGHJKLZXCVBNM123456\"}"
}
```

The actual processed JSON Request body looks like the following:

```
{
    "Request":"Y7mg/9WbP6FPVkYew5dRRuxtjH7OOR6NJWakEj/kwqZ56AjjQzJAV.....TtOGcm",
    "ApiKey":"unhqcdoY9l6yLf....."
}
```

## **The Decrypted Result of the Response**

The response data format as below :

```
{
    "Response":"WCTG0AI44/Ju/AEM6F.....UPLqHMDuI"
}
```

The data of the response field is Base64-encoded AES encryption data. Use the same AES key you used for encrypting the original request body to decrypt the response field in order to get the original response content (which is in JSON format).\\
