Authentication & Request Signing

Official endpoint and environments

Use https://open.fusionconnectgroup.com as the Open Platform base URL. The request URL is the base URL plus the operation path; for example https://open.fusionconnectgroup.com/openapi/v1/glink/search/destination. Only the path participates in signing.

Sandbox and production credentials are separate. Confirm the App Key, App Secret, product authorization and outbound-IP whitelist belong to the target environment.

Required request headers

Header	Required	Purpose
`Content-Type`	Yes	`application/json`
`X-OP-App-Key`	Yes	Application key (`open_app_id`).
`X-OP-Timestamp`	Yes	Unix seconds, Unix milliseconds or RFC3339; keep within ±5 minutes.
`X-OP-Nonce`	Yes	Fresh random value; never reuse it under the same App Key.
`X-OP-Sign`	Yes	Lowercase-hex HMAC-SHA256 signature.
`X-OP-Client-Request-Id`	Recommended	Your troubleshooting correlation ID.
`X-Trace-Id`	Recommended	Trace ID; the platform generates one if omitted.
`X-Idempotency-Key`	Recommended for writes	Use for create, pay, cancel and checkout operations.

Canonical string

Join these seven lines with newline characters (

METHOD

PATH

CANONICAL_QUERY

BODY_SHA256

TIMESTAMP

NONCE

APP_KEY

METHOD: uppercase method.
PATH: exact /openapi/v1/glink/... path; do not include host, protocol or port.
CANONICAL_QUERY: sort query keys and repeated values; keep an empty line if no query exists.
BODY_SHA256: lowercase SHA256 of raw UTF-8 request bytes; an empty body uses SHA256 of an empty byte string.

Sign this canonical string with open_app_secret using HMAC-SHA256, then send the lowercase-hex result as X-OP-Sign. Changing JSON whitespace after signing invalidates the request.

Common response envelope

Responses can include request_id, trace_id, downstream_request_id, code, message and data. Persist the IDs and use code=SUCCESS as the business success condition; HTTP 200 alone is insufficient.

Do and do not

Send only request-specific business fields from this API Reference — no supplier secret, supplier signature or legacy header/businessRequest wrapper.
Generate a new timestamp, nonce and signature for every request attempt.
Keep App Secret signing on your backend; never embed it in a browser, mobile client or public repository.
For writes, store your request ID and idempotency key before transmission and reconcile before retrying.

Common failures

Code	Check
`APP_KEY_INVALID`	Correct App Key and environment.
`SIGN_ERROR`	Exact path, raw body, query ordering, timestamp, nonce, App Secret and newline order.
`TIMESTAMP_EXPIRED`	Server clock and fresh timestamp.
`NONCE_REPLAY`	Generate a new nonce; do not replay a request.
`IP_WHITELIST_REJECTED`	Customer outbound IP is registered for the target environment.