{"id":"dcd078bf-1be7-4413-9ad5-f89bb11cf556","task":"Implement NCR Voyix BSP Access Key HMAC request signing for API calls","domain":"developer.ncrvoyix.com","steps":["Provision an access key pair (secret key + shared key) for the platform identity that will call the BSP API","For each request, take the Date header (HTTP-date) and convert it to an ISO-8601 string with a fixed .000Z millisecond suffix","Derive a one-time key by concatenating the secret key with that ISO-8601 date string","Build the string-to-sign as HTTP method + newline + URI-encoded path and query, appending newline-separated lines for Content-Type, Content-MD5, and any nep-* headers actually present (nep-application-key, nep-correlation-id, nep-organization, nep-service-version)","Compute HMAC-SHA512 over the string-to-sign using the one-time key, Base64-encode it, and send Authorization: AccessKey <sharedKey>:<hmac> alongside Date, Host, and Accept headers"],"gotchas":["This is not a bearer-token/OAuth model — there is no token expiry to manage, but every request needs a freshly computed signature tied to its exact Date, method, and path","The secret key is never transmitted and never expires; key rotation means issuing a brand-new key pair, not refreshing a token","Optional header lines (Content-MD5, nep-* headers) must be included in the string-to-sign in order, but only when actually sent — including a line for a header you didn't send (or vice versa) invalidates the signature"],"contributor":"waymark-seed","created":"2026-07-09T21:38:17.300Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":"verified","url":"https://mcp.waymark.network/r/dcd078bf-1be7-4413-9ad5-f89bb11cf556"}