-
Multi Bank Virtual POS
Multi Bank Virtual POS
Decoding the Response Token General Description
The response returned from Tami Virtual POS APIs is a JWT signed with HS512 (JWS). Unlike the request, it is not encrypted — meaning its content can be read directly — but its signature must be verified before it is processed.
How Does It Work?
The response is a standard JWT made up of 3 parts separated by dots. The signature was applied using the k value in the JWK delivered to you, meaning it is verified with the same key used when generating the token.
verify( signedResponse, HS512, k ) → if valid, the claims are read
Claims Inside the Response
| Claim | Value |
|---|---|
| iss | “tami” (fixed) |
| aud | the merchant’s merchant:terminal information, in the form “<merchantNumber>:<terminalNumber>“ (example: “77006950:84006953”) |
| jti / iat / exp | unique identifier, generation time, validity period (+10 minutes) |
| tami:body | the actual response body (JSON); the data to be processed is located here |
| tami:apiVersion | “v4” |
What You Need to Do
- The signature must be verified (HS512 + k). A response whose signature cannot be verified must not be processed.
- It must be checked that the aud value matches the merchant’s own merchant:terminal information.
- The JSON inside tami:body must be taken and processed according to the response parameters defined on the relevant transaction page.
The verify function of the JOSE library used for token generation is sufficient for this verification; no additional setup is required. For ready-made examples, see the “Code Samples” heading below.
Code Samples
Ready-made, runnable examples for the following languages are available on the Code Samples page. All examples are a direct implementation of the 3-step flow above; you can select the relevant language, enter the values, and run it.
