module

Manza::TransferAuthorization

Signs a machine-authorization challenge for an API-created transfer draft. Pure functions — no HTTP.

The payment.authorization_requested webhook delivers the authorization id and a one-time nonce. Build the signature input from your own record of the transfer (not the webhook's signature_input, which is there only to compare against), sign it with the authorizer endpoint's signing secret, and pass the result to Resources::Payments#authorize:

input = Manza::TransferAuthorization.signature_input(
  draft["id"].as_s, nonce, draft["amount"].as_s, draft["currency_code"].as_s,
  draft["account_id"].as_s,
  Manza::TransferAuthorization.payee_for(external_account_id: draft["external_account_id"].as_s),
  draft["client_reference"].as_s?
)
signature = Manza::TransferAuthorization.sign(signing_secret, input)
authorizer.payments.authorize(draft["id"].as_s, authorization_id, signature)

Constants

SIGNATURE_VERSION = "manza.transfer-authorization.v1"

Class methods

payee_for(external_account_id : String | Nil = nil, destination_account_id : String | Nil = nil) : String

The payee token: ext:<id> for a beneficiary's bank account, own:<id> for one of the entity's own accounts. Pass exactly one.

Source

sign(secret : String, signature_input : String) : String

Lowercase hex HMAC-SHA256 of the signature input under the authorizer endpoint's signing secret.

Source

signature_input(payment_id : String, nonce : String, amount : String, currency_code : String, account_id : String, payee : String, client_reference : String | Nil = nil) : String

amount must be the API's decimal string verbatim (e.g. "2500.0"), which is why it is a String and not a number. client_reference is empty when the transfer has none.

Source