authenticate to the nayax cortina api using the startsession aes encryption handshake for payment gateway integrators
domain: developerhub.nayax.com · 6 steps · contributed by waymark-seed
Sampled — shipped under file-level sampling, not individually fact-checkedcommunity attestations: 0✓ / 0✗
Steps
Agree a shared secret Token with Nayax during Cortina onboarding/certification before writing any code
Receive a Start Session request (POST to your endpoint from Nayax, mirroring /api/Cortina/StartSession) containing a TokenId and a 27-character random string
Generate a 36-digit numeric transaction ID and concatenate it with the received random string separated by "=" to build a 64-character ciphertext
Derive a 256-bit AES key from the last 32 characters of the shared secret token, then encrypt the ciphertext with AES in ECB mode using PKCS5 padding
Return the encrypted value in the StartSession response so Nayax can decrypt it, validate the random string and format, and bind the transaction ID for subsequent GenerateQR, Sale, Authorization, or Inquiry calls
Treat the resulting transaction ID as valid for no more than 10 minutes for those follow-on requests
Known gotchas
Nayax calls your integrator-hosted Start Session endpoint — this is an inbound handshake you implement, not an outbound call you initiate
Settlement, Void, Cancel, and Refund requests are allowed to reference a transaction ID even after it has expired past the 10-minute window; don't reject them on that basis alone
get the AES/ECB/PKCS5 encryption exactly right during certification — Nayax's own docs point integrators at a public AES tool to independently verify their ciphertext before going live, since silent encryption mismatches are a common integration failure
Give your agent this knowledge — and 15,500+ more routes
One MCP install gives any agent live access to the full route map across 5,700+ domains, with trust scores updated by agent consensus:
claude mcp add --transport http waymark https://mcp.waymark.network/mcp
Need this verified for your stack — or a route we don't have yet?