Postman Collection Setup

Use our Postman collection to test IIMMPACT API endpoints without writing HMAC signing code. The collection includes a pre-request script that signs every request with API Key + HMAC-SHA256 authentication.

Import the collection

Download and import the collection file into your Postman workspace:

• Download API Key HMAC Collection

The collection includes example requests for:

• GET /v2/balance — safest request to verify authentication
• GET /v2/bill-presentment — ready-to-run TNB example
• GET /v2/bill-presentment — includes both a ready-to-run TNB example and a JomPAY example with biller_code, optional ref2, and amount
• GET /v2/catalog — fetch the product catalog
• GET /v2/options — example request with signed query parameters
• GET /v2/product-list and GET /v2/subproducts — legacy endpoints still used by some integrators
• GET /v2/networkstatus, GET /v2/transactions, and GET /v2/balance-statement
• POST /v2/topup — includes basic, JomPAY, JomPAY with ref2, PTPTN, and mobile data examples

The current collection keeps account and catalog examples read-only. The only write examples left are the POST /v2/topup variants.

Import an environment

Choose and import one environment:

Staging

• For testing and development
• Download Staging Environment

Production

• For live/production use
• Download Production Environment

WARNING

Only use production credentials when you intend to call the live API. Requests like POST /v2/topup can create real transactions.

Configure API Key authentication

After importing the environment, select it in Postman and fill in these variables:

Variable	Description
baseUrl	API base URL. Use https://staging.iimmpact.com for staging or https://api.iimmpact.com for production.
apiKey	Your IIMMPACT API key from Developer > API Keys in the dashboard.
hmacSecret	Your Base64-encoded HMAC secret from the dashboard. Paste the original Base64 value; the collection decodes it before signing.

The collection automatically adds these headers before every request:

Header	Generated value
X-Api-Key	Your apiKey environment variable
X-Timestamp	Current Unix timestamp in seconds
X-Nonce	A unique nonce for replay protection
X-Signature	v1= followed by the Base64 HMAC-SHA256 signature

Test the setup

1. Import the collection.
2. Import the correct environment (staging or production).
3. Select the environment in the top-right Postman environment picker.
4. Fill in apiKey and hmacSecret.
5. Send Account > Get Balance.

A successful setup returns 200 OK with your account balance. If you see 401 Unauthorized, open the Postman Console and compare the logged canonical string with the signing rules in API Key Authentication.

Setup checklist

1. Import the API Key HMAC collection.
2. Import the correct environment (staging or production).
3. Select the imported environment.
4. Fill in apiKey and hmacSecret.
5. Send Account > Get Balance first.

TIP

If you see 401 Unauthorized, review API Key Authentication and verify your HMAC secret is Base64-decoded before signing.