API Authentication

Before using Saber’s APIs or SDK, generate an authentication signature — the process differs slightly depending on the type of request.

Receiving keys

Saber provides two key sets — sandbox and production — each with an API Key (client_id) and API Secret (client_secret). Use these to generate an authentication token (API Signature) for your requests.

Contact your Saber representative to get access to Saber dashboard. API Keys are generated from the dashboard.

Generating the authentication token

Generate a timestamp

var timestamp = Math.floor(Date.now() / 1000).toString();

Create the signature string

The signature string differs by request type:

Admin Operation
User Operation
Web Widget / SDK

For merchant-level requests not tied to a specific user (e.g. create a user):

var sigString = clientId + timestamp;

For requests tied to a specific user (e.g. create an OFFRAMP transaction):

var sigString = clientId + timestamp + user_id;

Generate the HMAC-SHA256 signature

var signature = CryptoJS.HmacSHA256(sigString, clientSecret).toString().toUpperCase();

The resulting signature can now be used to authenticate API requests.

Full example

// Variables (these should be securely stored and handled)
var clientId = 'YOUR_API_KEY'; // Replace with your actual API Key
var clientSecret = 'YOUR_API_SECRET'; // Replace with your actual client secret

// Step 1: Generate timestamp
var timestamp = Math.floor(Date.now() / 1000).toString();

// Step 2: Create the signature string
var sigString = clientId + timestamp; // Admin operation (e.g. create a user)
// ------- OR -------
// var sigString = clientId + timestamp + user_id; // User operation (e.g. create OFFRAMP transaction)
// ------- OR -------
// var sigString = clientId + timestamp + 'sdk' + user_id; // Web Widget / SDK access

// Step 3: Generate the HMAC-SHA256 signature
var signature = CryptoJS.HmacSHA256(sigString, clientSecret).toString().toUpperCase();

Request headers

The earlier header names X-CLIENT-ID (client ID) and X-CLIENT-SECRET (generated signature) have been replaced:

Old header	New header
`X-CLIENT-ID`	`X-API-KEY`
`X-CLIENT-SECRET`	`X-SIGNATURE`

You may still find the older names referenced in some documentation. We suggest using the new headers, but both work — they’re backwards compatible.

Getting Started

Client Admin Operations

Offramp

Onramp

User Operations

Receiving keys

Generating the authentication token

Full example

Request headers

Understanding the Platform

Sandbox Functionality

Developer Section

​Receiving keys

​Generating the authentication token

​Full example

​Request headers

​Related pages

Understanding the Platform

Sandbox Functionality

Developer Section

Receiving keys

Generating the authentication token

Full example

Request headers

Related pages