SDK Overview & Downloads

The platform ships official SDKs for five languages: PHP, Python, Node.js, Go, and Java. Each SDK is a single source file — copy it straight into your project. We do not publish to public registries such as Composer, PyPI, or npm.

All SDKs implement the same v2 protocol: RSA-OAEP (SHA-1) encryption, SHA256withRSA signatures, and timestamp + nonce replay protection. See Encryption & Signature Protocol for the protocol details.

The Five Languages at a Glance

The core encrypt / decrypt / sign / verify capabilities are identical across all SDKs. What differs is how much of getToken and HTTP is wrapped for you:

Language	Source file	Dependencies	Capabilities	Docs
PHP	sdk/php/AnonyV2Client.php	openssl extension	Fully automatic getToken($secret) (HTTP call included); post() handles encrypt, sign, send, verify, and decrypt in one step	PHP SDK
Python	sdk/python/anony_v2.py	cryptography	auth_header() computes the getToken auth header, build_request() builds the encrypted signed request, verify_response() verifies and decrypts; bring your own HTTP library (e.g. requests)	Python SDK
Node.js	sdk/node/anony_v2.js	Built-in crypto (getToken requires Node ≥ 18)	Fully automatic getToken(secret); use buildRequest() + verifyResponse() together with fetch	Node.js SDK
Go	sdk/go/anonyv2.go	Standard library	Crypto primitives: Encrypt / Decrypt / Sign / Verify / Canonical / NewNonce / AuthHeader; HTTP and JSON serialization are up to you	Go SDK
Java	sdk/java/AnonyV2Client.java	JDK standard library	Static-method primitives: encrypt / decrypt / sign / verify / canonical / newNonce / buildHeaders / authHeader; bring your own HTTP client	Java SDK

In short:

• PHP / Node.js: the most complete wrappers — getToken works out of the box, and a single call handles the entire envelope for each business request.
• Python: a three-piece toolkit — auth_header (computes auth + md5(APP-ID & secret)), build_request, and verify_response — while you send the HTTP requests yourself.
• Go / Java: expose every primitive — encryption, signing, the canonical string, nonce generation, and AuthHeader — leaving the HTTP client and JSON library entirely up to you. A good fit when integrating into an existing service framework.

The getToken response is an encrypted, signed envelope like every other endpoint — not a plaintext token. Whichever language you use, you must verify the signature and decrypt before reading the token field. See Get token.

Download

The SDKs ship as a single archive:

Download merchant-api-v2.tar.gz

A checksum file, merchant-api-v2.tar.gz.sha256, is available in the same directory. Verify the archive's integrity before extracting:

Linux

# Download the tar.gz and .sha256 into the same directory, then run:
sha256sum -c merchant-api-v2.tar.gz.sha256   # "merchant-api-v2.tar.gz: OK" means it passed
tar -xzf merchant-api-v2.tar.gz

macOS

shasum -a 256 -c merchant-api-v2.tar.gz.sha256
tar -xzf merchant-api-v2.tar.gz

If verification fails (output shows FAILED), the file was corrupted in transit or tampered with — download it again. If it still fails, contact the platform.

Archive Contents

merchant-api-v2.tar.gz
├── README.md                        # Full integration guide (protocol spec, API reference, troubleshooting)
└── sdk/
    ├── php/AnonyV2Client.php        # PHP SDK
    ├── python/anony_v2.py           # Python SDK
    ├── node/anony_v2.js             # Node.js SDK
    ├── go/anonyv2.go                # Go SDK
    ├── go/go.mod                    # Go module definition
    └── java/AnonyV2Client.java      # Java SDK

The archive contains no keys of any kind. Your APP-ID, secret, the platform public key public_t, and your merchant private key private_u are issued by the platform / available in the merchant dashboard — see Keys & Credentials.

Key Format Reminder: base64(PEM)

SDKs take base64(PEM), not raw PEM

Every SDK expects key parameters in base64(PEM) format: take the standard PEM text (the entire -----BEGIN ... KEY----- block) and Base64-encode it one more time. The SDK Base64-decodes it back to PEM internally before loading the key — do not decode it yourself in advance, and do not pass raw PEM text directly.

• Merchant private key private_u: PKCS#8 (BEGIN PRIVATE KEY)
• Platform public key public_t: SPKI (BEGIN PUBLIC KEY)
• All keys are RSA-2048

See Keys & Credentials for format details and generation instructions. Keep the private key on your server only — never put it in frontend code, logs, or third-party systems.

Next Steps

1. Go to the SDK page for your language and run the example: PHP / Python / Node.js / Go / Java.
2. Call the go-live selfcheck with your real keys to confirm both the request and response paths work, then notify the platform to activate your integration.
3. If you hit signature or decryption failures during integration testing, work through the Troubleshooting Guide in order (OAEP using SHA-1, the canonical string, key roles, clock sync).