Coupang Partners API is authenticating using HMAC. Accordingly, companies using the Coupang Partners API must receive HMAC secret keys and access keys from Coupang.

Coupang must encrypt and deliver the HMAC secret key and access key. Accordingly, encryption/decryption should be performed through the following tasks to receive the HMAC key.

Proceeding in a window environment can lead to encoding problems. Please proceed with the encryption/decryption work using OpenPGP in a Linux environment.

Summary

• (Partner) You need to create a public/secret key using OpenPGP and forward the public key to Coupang.
• (Coupang) Encrypt the HMAC key using the received public key. The encrypted file is delivered to the partner.
• (Company) decrypts the encrypted file you received using the OpenPGP secret key. Set up the HMAC with the HMAC key obtained by decryption.

Instruction

Create a public/secret key using OpenPGP

Install OpenPGP.

$ sudo apt-get install gnupg (Linux)
$ brew install gnupg (MacOS)

Create a private key, public key using the following instructions:

$ gpg --gen-key
...
Real name: ${Name of the integrated company}    # ex. SAMSUNG, LGE, ...
Email address: ${E-mail from the integration team}

Representative emails can be replaced by those of other relevant employees.
When generation is complete, export the public key to the following command.

gpg -a --export coupang > coupang_pub_key.gpg

Forward the name of the integrated company you set with the exported public key to Coupang via mail (partner.support@coupang.com).

Decrypt the encrypted file you received using the OpenPGP secret key

Subsequently, decrypt the received coupang_HMAC_encrypted.txt file using the following command.

$ gpg -o coupang_HMAC_decrypted.txt --decrypt coupang_HMAC_encrypted.txt

HMAC access_key and secret_key are inside the coupang_HMAC_decrypted.txt file. You can proceed with HMAC setting in the system with the corresponding key.