Introduction¶

Saudi Arabia APIs

Introduction · Response Code · Checkout · Check Deposit Status · Deposit WayCode · Check Balance · Webhook

Brief Description¶

This section describes how to obtain API credentials, complete signature generation, and understand the supported collection API set for Saudi Arabia.
The Saudi Arabia market pages follow the same request signing and status handling conventions used across the Vexora platform.

Sandbox Account API Credentials¶

API Base Url: https://sandbox-api.vexora.com/saudi
Merchant Number (MID): 0506713352
Secret Key: 7010a8b7ccaa41fe9a15bdc8f14040c6

Prod Account API Credentials¶

After sandbox testing is completed, please contact your business or operations manager
to enable the Saudi Arabia production market for your merchant account.
Production credentials are issued from the merchant admin portal after approval.

Signature Generation Logic¶

To ensure request security, all API calls must include the signature parameter sign.

1. Signature Generation Steps¶

Step 1: Assemble the string to sign

Collect all request parameters except sign.
Sort parameters in ascending order by ASCII field name.
Concatenate them in the format key=value without separators.
Example: amount=100.00timestamp=1772323200000tradeNo=SA202607010001

Step 2: Generate the signature

Append the merchant App Secret to the end of the assembled string.
Calculate the MD5 hash of the combined value.
Convert the result to a lowercase hexadecimal string.

List<String> keys = Lists.newArrayList(map.keySet());
Collections.sort(keys);
StringBuilder request = new StringBuilder();
for (String key : keys) {
  String value = String.valueOf(map.get(key));
  if (StrUtil.isNotEmpty(value) && !"sign".equals(key)) {
    request.append(key).append("=").append(value);
  }
}

2. Core Parameter Specifications¶

Item	Value	Description
Signature Type	MD5	Required for all requests
Character Set	UTF-8	Required for request signing
Salt	App Secret	Secret key issued to the merchant

try {
  MessageDigest md5 = MessageDigest.getInstance("MD5");
  md5.update((str + salt).getBytes("UTF-8"));
  return byte2hex(md5.digest());
} catch (Exception e) {
  return "";
}

3. Additional Request Requirements¶

Merchant ID must be sent in the HTTP header as merchantNo.
If your server uses an IP whitelist, provide the outbound IP addresses before UAT or production testing.
Only enabled Saudi Arabia collection channels and way codes can be used in requests.

Request Method¶

All requests are POST requests.
The request body format is json.