5. Authorization

When communicating over HTTP using Beckn APIs, the subscribers need to authenticate themselves to perform transactions with other subscribers. Due to the commercial nature of the transactions, every request/callback pair is considered to be a "contract" between two parties. Therefore, it is imperative that all requests and callbacks are digitally signed by the sender and subsequently verified by the receiver.

Below document describes a way for network subscribers (BAP/BPPs) and proxy subscribers (BGs) to simultaneously add authentication and message integrity to HTTP messages by using digital signatures.

Here is a document to help you with the requirements and understanding the Auth Header Signing and Verification process and utilities available for the same.

Signing and Verification Utilities: This utility will help you generate key pairs, create/verify authorization headers.