The Iconic - Authentication

Purpose of this document is to provide information on the ‘The Iconic’ authentication requirements

API Docs: Signing Requests · Seller Center Seller API

The Authentication is done via API Key. The API Key is generated from the Seller Center portal (Settings > Manage Users).

API Key status could be found into the Seller Center portal ( Picture 1);

Picture 1:

Once generated, the API Key encoded according to RFC 3986 standard.

Links to Seller Center portal:

URLs LIVE https://sellercenter.theiconic.com.au

TEST (Preprod) https://sellercenter-preprod.theiconic.com.au

Example:

<?php

// Pay no attention to this statement.
// It's only needed if timezone in php.ini is not set correctly.
date_default_timezone_set("UTC");

// The current time. Needed to create the Timestamp parameter below.
$now = new DateTime();

// The parameters for our GET request. These will get signed.
$parameters = array(
    // The user ID for which we are making the call.
    'UserID' => 'look@me.com',

    // The API version. Currently must be 1.0
    'Version' => '1.0',

    // The API method to call.
    'Action' => 'FeedList',

    // The format of the result.
    'Format' => 'XML',

    // The current time formatted as ISO8601
    'Timestamp' => $now->format(DateTime::ISO8601)
);

// Sort parameters by name.
ksort($parameters);

// URL encode the parameters.
$encoded = array();
foreach ($parameters as $name => $value) {
    $encoded[] = rawurlencode($name) . '=' . rawurlencode($value);
}

// Concatenate the sorted and URL encoded parameters into a string.
$concatenated = implode('&', $encoded);

// The API key for the user as generated in the Seller Center GUI.
// Must be an API key associated with the UserID parameter.
$api_key = 'b1bdb357ced10fe4e9a69840cdd4f0e9c03d77fe';

// Compute signature and add it to the parameters.
$parameters['Signature'] =
    rawurlencode(hash_hmac('sha256', $concatenated, $api_key, false));

There are some encryptions required for the signature and the parameters. More specifically, the signature parameter we require on all calls is the SHA256 hash of the request string.

More specifically, the signature parameter we require on all calls is the HMAC of the request string and your API key with the SHA256 digest algorithm.