HP Site Flow API Authentication

HP Site Flow API Authentication

To connect to the HP Site Flow APIs, all requests must be authenticated. Please follow the guides below to authenticate against our API’s.

TLS

Connecting to Site Flow RESTful API’s will require at least TLS 1.2 for all HTTPS connections.

If you need help to ensure that your environment is ready for this you can follow one of these checks.

Authentication

Site Flow RESTful API’s use an HTTP Authorization header to pass authorization information. Under the Site Flow authorization scheme, the Authorization header has the following form:

x-oneflow-authorization: Token:Signature

API calls are authenticated based on a Token/Secret that is generated from within your organization. Please contact Site Flow support to request a token/secret for API authentication.

Token/secrets are generated with various roles assigned to them, from basic order submission to full owner-level which will grant you access to full API access.

The authentication header is an HMAC SHA256 of selected elements from the request, so the Signature part of the Authorization header will vary from request to request.

If the request signature calculated by the system matches the Signature included with the request, the requester will have demonstrated possession of the Site Flow secret access key. The request will then be processed under the identity, and with the authority, of the developer to whom the key was issued.

In addition to the Authorization header the request must also contain a ‘x-oneflow-date’ header which contains the timestamp used in the Signature encryption, and a ‘x-oneflow-algorithm’ header which contains the hash algorithm that was used (i.e. ‘SHA256’). Below is an example of the 3 headers used in API request

x-oneflow-authorization: 124213431243214:431c0baaac21060fbba3a8c35c74ff565ec0113f6031586b99d978ffb6686e5b

x-oneflow-date: 2026-01-01T17:16:18.000Z

x-oneflow-algorithm: SHA256

Generating The Authorization Request Header

The authentication header is created by hashing a string comprised of the following fields: 'Method Endpoint Timestamp' (separated by spaces) where:

• Method - is the HTTP method used for this call (e.g. GET, POST, PUT). This must be in ALL CAPS.
• Endpoint - is the API endpoint that you are attempting to call beginning with '/api'. For example '/api/order' would be used to call the GET all orders endpoint. Note that any query parameters are not included in the hash string. Anything including or after the '?' character in the URL should not be included in the hash.
• Timestamp - is the current time in ISO 8601 timestamp format (i.e. 2026-01-01T12:00:00.000Z ). note that this timestamp must match the value provided in the x-oneflow-date header. We recommend formatting this timestamp in Zulu format with a trailing 'Z'.

As an example if I am trying to make a call to get all orders the string to be hashed would look like this: 'GET /api/order 2026-01-01T12:00:00.000Z'

The authentication header must be re-generated for each API call including a current timestamp. Timestamps / Authentication headers will be rejected if they are older than 10 minutes from the submission time.

Below are some code examples which generate the `x-oneflow-authorization` header detailed above. You can also view our GitHub page for additional code samples.

JavaScript

// We use the crypto NPM module for encryption of the signature
var crypto = require('crypto');
var timestamp = (new Date()).toISOString();
    
// Note path must be percent decoded
var stringToSign = method + " " + decodeURIComponent(path) + " " + timestamp;
var hmac = crypto.createHmac("SHA256", secret);
hmac.update(stringToSign);
var signature = hmac.digest("hex");
var authHeader = token + ":" + signature;

C#

// Required for use HMACSHA256:
using System;
using System.Security.Cryptography;
    
// Note path must be percent decoded
string stringToSign = method + " " + Uri.UnescapeDataString(path) + " " + timestamp;
HMACSHA256 hmac = new HMACSHA256(Encoding.UTF8.GetBytes(secret));
byte[] signatureBytes = hmac.ComputeHash(Encoding.UTF8.GetBytes(stringToSign));
string signature = BitConverter.ToString(signatureBytes).Replace("-", "").ToLower();
string authHeader = token + ":" + signature;

PHP

<?php
   // Note path must be percent decoded
   $stringToSign = strtoupper($method) . ' ' . urldecode($path) . ' ' . $timestamp;
   $signature = hash_hmac('sha256', $stringToSign, $secret);
   $authHeader = $token . ':' . $signature;
?>