@payware/mcp-server 1.1.1 → 1.3.0

package/README.md

@@ -10,10 +10,11 @@ Official MCP (Model Context Protocol) server for payware payment API integration
 - **ISVs (Independent Software Vendors)** - Build multi-merchant platforms with OAuth2 token management
 - **Payment Institutions** - Process A2A transfers, handle Payment Choice Architecture with multiple payment methods
 
-## What's New in v1.1.0
+## What's New in v1.2.0
 
-- **Point of Interaction (POI)** - Full POI management: set prices, get status, generate QR codes, list and manage POIs
-- **Payment Choice Architecture** - Support for `paymentMethod` field (A2A, CARD_FUNDED, BNPL, INSTANT_CREDIT) in transaction processing
+- **SHA-256 Authentication** - Upgraded from MD5 to SHA-256 for JWT content hashing (`contentSha256` header)
+- **Updated Error Codes** - New error codes: `ERR_INVALID_CONTENT_HASH`, `ERR_MISSING_CONTENT_HASH`
+- **Backward Compatibility** - Deprecated MD5 functions retained for legacy support
 
 ## Features
 
@@ -37,6 +38,11 @@ Official MCP (Model Context Protocol) server for payware payment API integration
 - **Get QR Code**: Generate QR code for POI payments
 - **List POIs**: List all POIs for a merchant
 
+### 📋 Logs Tools (Premium)
+- **Query Logs**: Search and filter application logs by level, logger, message content, and date range
+- **Log Status**: Check log availability and storage information
+- **Download Logs**: Get compressed archive of logs for offline analysis
+
 ### 🛠️ Utility Tools
 - **Advanced Code Generation**: Generate complete integration code across 8 languages (Python, Node.js, PHP, Java, C#, Go, Ruby, cURL) with 16+ framework support
 - **Framework Integration**: Framework-specific examples for Django, FastAPI, Express, NestJS, Laravel, Spring Boot, ASP.NET, and more
@@ -375,7 +381,7 @@ Generate comprehensive API documentation with code examples.
 - `outputFormat` (optional): markdown, html, json (default: markdown)
 
 #### `payware_utils_format_request`
-Format and validate API requests with deterministic JSON serialization for MD5 consistency.
+Format and validate API requests with deterministic JSON serialization for SHA-256 consistency.
 
 **Parameters:**
 - `type` (required): transaction, headers, or curl
@@ -386,7 +392,7 @@ Format and validate API requests with deterministic JSON serialization for MD5 c
 - `method` (optional): HTTP method (default: POST)
 
 #### `payware_utils_format_json_deterministic`
-Format JSON with deterministic property ordering for consistent MD5 calculation.
+Format JSON with deterministic property ordering for consistent SHA-256 calculation.
 
 **Parameters:**
 - `data` (required): Object to serialize
@@ -395,7 +401,7 @@ Format JSON with deterministic property ordering for consistent MD5 calculation.
 #### `payware_utils_server_info`
 Get MCP server information and configuration.
 
-**Note:** All transaction data is serialized using consistent property ordering to prevent MD5 mismatch errors.
+**Note:** All transaction data is serialized using consistent property ordering to prevent content hash mismatch errors.
 
 ## Dependencies
 
@@ -435,12 +441,12 @@ Get MCP server information and configuration.
 - Validate all input parameters
 - Implement rate limiting and monitoring
 
-### JSON Serialization & MD5 Consistency
-⚠️ **CRITICAL**: payware API requires deterministic JSON serialization for MD5 calculation
+### JSON Serialization & SHA-256 Consistency
+⚠️ **CRITICAL**: payware API requires deterministic JSON serialization for SHA-256 calculation
 
 - **Property Order**: JSON objects must have consistent property ordering
 - **Minimized Format**: No whitespace or formatting in request bodies
-- **MD5 Calculation**: Must be calculated from the exact same JSON string sent to API
+- **SHA-256 Calculation**: Must be calculated from the exact same JSON string sent to API
 - **Implementation**: This server uses deterministic JSON serialization to ensure consistency
 
 **Example of correct JSON format:**
@@ -449,9 +455,9 @@ Get MCP server information and configuration.
 ```
 
 **Why this matters:**
-- Different property orders produce different MD5 hashes
-- MD5 mismatch results in `ContentMd5 mismatch` errors
-- Server validates that JWT contentMd5 matches request body MD5
+- Different property orders produce different SHA-256 hashes
+- Hash mismatch results in `ERR_INVALID_CONTENT_HASH` errors
+- Server validates that JWT `contentSha256` matches request body SHA-256
 
 ## Troubleshooting
 
@@ -463,11 +469,11 @@ Get MCP server information and configuration.
    - **Verification**: Use `openssl rsa -in privateKey.pem -pubout` to extract public key from private key
    - **Status**: ✅ Resolved - Keys must be properly registered on payware partner portal
 
-2. **ContentMd5 Mismatch Error**
+2. **Content Hash Mismatch Error (ERR_INVALID_CONTENT_HASH)**
    - **Root Cause**: Inconsistent JSON property ordering
    - **Solution**: Use deterministic JSON serialization (implemented in this server)
-   - **Symptoms**: Server logs show different expected vs actual MD5 hashes
-   - **Prevention**: Always use `createMinimizedJSON()` from `/src/utils/json-serializer.js`
+   - **Symptoms**: Server logs show different expected vs actual SHA-256 hashes
+   - **Prevention**: Always use `createMinimizedJSON()` from `/src/core/utils/json-serializer.js`
    - **Status**: ✅ Fixed - Deterministic JSON serialization implemented
 
 3. **Transaction Creation Failed**
@@ -500,7 +506,7 @@ Get MCP server information and configuration.
 - JWT token creation with RS256 algorithm
 - Transaction creation (POST /api/transactions)
 - Transaction cancellation (PATCH /api/transactions/{id})
-- Deterministic JSON serialization for MD5 consistency
+- Deterministic JSON serialization for SHA-256 consistency
 - Public/private key pair validation
 
 **🧪 Test Results:**

package/package.json

@@ -1,66 +1,69 @@
-{
-  "name": "@payware/mcp-server",
-  "version": "1.1.1",
-  "description": "Official MCP server for payware payment API integration",
-  "main": "src/index.js",
-  "type": "module",
-  "bin": {
-    "payware-mcp": "./src/index.js"
-  },
-  "scripts": {
-    "start": "node src/index.js",
-    "dev": "node --watch src/index.js",
-    "proxy": "node src/proxy-server.js",
-    "proxy:dev": "node --watch src/proxy-server.js",
-    "bridge": "node src/mcp-proxy.js",
-    "inspector": "npx @modelcontextprotocol/inspector node src/mcp-proxy.js"
-  },
-  "dependencies": {
-    "@modelcontextprotocol/sdk": "^0.5.0",
-    "axios": "^1.6.0",
-    "cors": "^2.8.5",
-    "dotenv": "^17.2.2",
-    "express": "^5.1.0",
-    "http-proxy-middleware": "^3.0.5",
-    "jsonwebtoken": "^9.0.0",
-    "node-forge": "^1.3.1"
-  },
-  "engines": {
-    "node": ">=18.0.0"
-  },
-  "keywords": [
-    "mcp",
-    "model-context-protocol",
-    "payware",
-    "payments",
-    "payment-gateway",
-    "payment-processing",
-    "api",
-    "fintech",
-    "pos",
-    "terminal",
-    "merchant",
-    "isv",
-    "oauth2"
-  ],
-  "author": "payware <support@payware.com>",
-  "license": "MIT",
-  "repository": {
-    "type": "git",
-    "url": "git+https://github.com/payware/mcp-server.git"
-  },
-  "bugs": {
-    "url": "https://github.com/payware/mcp-server/issues"
-  },
-  "homepage": "https://github.com/payware/mcp-server#readme",
-  "files": [
-    "src/",
-    "keys/README.md",
-    "README.md",
-    "check-keys.js",
-    "mcp-config.json",
-    "payware-mcp-config.json",
-    ".env.example",
-    "MCP-SETUP.md"
-  ]
-}
+{
+  "name": "@payware/mcp-server",
+  "version": "1.3.0",
+  "description": "Official MCP server for payware payment API integration",
+  "main": "src/index.js",
+  "type": "module",
+  "bin": {
+    "payware-mcp": "src/index.js"
+  },
+  "scripts": {
+    "start": "node src/index.js",
+    "dev": "node --watch src/index.js",
+    "proxy": "node src/proxy-server.js",
+    "proxy:dev": "node --watch src/proxy-server.js",
+    "bridge": "node src/mcp-proxy.js",
+    "inspector": "npx @modelcontextprotocol/inspector node src/mcp-proxy.js",
+    "test": "node --test tests/api-errors.test.js tests/json-serializer.test.js tests/request-contract.test.js tests/tool-contract.test.js",
+    "test:watch": "node --test --watch tests/api-errors.test.js tests/json-serializer.test.js tests/request-contract.test.js tests/tool-contract.test.js",
+    "check": "node --check src/index.js && npm test"
+  },
+  "dependencies": {
+    "@modelcontextprotocol/sdk": "^0.5.0",
+    "axios": "^1.6.0",
+    "cors": "^2.8.5",
+    "dotenv": "^17.2.2",
+    "express": "^5.1.0",
+    "http-proxy-middleware": "^3.0.5",
+    "jsonwebtoken": "^9.0.0",
+    "node-forge": "^1.3.1"
+  },
+  "engines": {
+    "node": ">=18.0.0"
+  },
+  "keywords": [
+    "mcp",
+    "model-context-protocol",
+    "payware",
+    "payments",
+    "payment-gateway",
+    "payment-processing",
+    "api",
+    "fintech",
+    "pos",
+    "terminal",
+    "merchant",
+    "isv",
+    "oauth2"
+  ],
+  "author": "payware <support@payware.com>",
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/payware/mcp-server.git"
+  },
+  "bugs": {
+    "url": "https://github.com/payware/mcp-server/issues"
+  },
+  "homepage": "https://github.com/payware/mcp-server#readme",
+  "files": [
+    "src/",
+    "keys/README.md",
+    "README.md",
+    "check-keys.js",
+    "mcp-config.json",
+    "payware-mcp-config.json",
+    ".env.example",
+    "MCP-SETUP.md"
+  ]
+}

package/src/auth/sandbox-setup.js

@@ -1,187 +1,187 @@
-/**
- * Setup sandbox authentication configuration
- */
-
-import { getPartnerIdSafe, getPrivateKeySafe } from '../config/env.js';
-
-const SANDBOX_CONFIG = {
-  baseUrl: 'https://sandbox.payware.eu/api',
-  apiVersion: '1',
-  environment: 'sandbox',
-  supportedCurrencies: [
-    // Major currencies
-    'EUR', 'USD', 'GBP', 'JPY', 'CHF', 'CAD', 'AUD', 'CNY', 'SEK', 'NOK', 'DKK',
-    // All other supported currencies (100+ total)
-    'AED', 'AFN', 'ALL', 'AMD', 'ANG', 'AOA', 'ARS', 'AWG', 'AZN',
-    'BAM', 'BBD', 'BDT', 'BGN', 'BHD', 'BIF', 'BMD', 'BND', 'BOB', 'BRL', 'BSD', 'BTC', 'BTN', 'BWP', 'BYN', 'BZD',
-    'CDF', 'CLP', 'COP', 'CRC', 'CUP', 'CVE', 'CZK',
-    'DJF', 'DOP', 'DZD',
-    'EGP', 'ERN', 'ETB',
-    'FJD', 'FKP',
-    'GEL', 'GHS', 'GIP', 'GMD', 'GNF', 'GTQ', 'GYD',
-    'HKD', 'HNL', 'HRK', 'HTG', 'HUF',
-    'IDR', 'ILS', 'INR', 'IQD', 'IRR', 'ISK',
-    'JMD', 'JOD',
-    'KES', 'KGS', 'KHR', 'KMF', 'KPW', 'KRW', 'KWD', 'KYD', 'KZT',
-    'LAK', 'LBP', 'LKR', 'LRD', 'LSL', 'LYD',
-    'MAD', 'MDL', 'MGA', 'MKD', 'MMK', 'MNT', 'MOP', 'MRO', 'MUR', 'MVR', 'MWK', 'MXN', 'MYR', 'MZN',
-    'NAD', 'NGN', 'NIO', 'NPR', 'NZD',
-    'OMR',
-    'PAB', 'PEN', 'PGK', 'PHP', 'PKR', 'PLN', 'PYG',
-    'QAR',
-    'RON', 'RSD', 'RUB', 'RWF',
-    'SAR', 'SBD', 'SCR', 'SDG', 'SGD', 'SHP', 'SLL', 'SOS', 'SRD', 'STD', 'SVC', 'SYP', 'SZL',
-    'THB', 'TJS', 'TMT', 'TND', 'TOP', 'TRY', 'TTD', 'TWD', 'TZS',
-    'UAH', 'UGX', 'UYU', 'UZS',
-    'VND', 'VUV',
-    'WST',
-    'XAF', 'XCD', 'XOF', 'XPF',
-    'YER',
-    'ZAR', 'ZMW', 'ZWL'
-  ], // ISO 3-character codes
-  supportedTransactionTypes: ['PLAIN', 'QR', 'BARCODE'], // trOptions.type values
-  transactionTypes: ['DEFAULT', 'SHIPPABLE'], // transactionType values
-  maxAmount: 'Unlimited', // Limited by Java type implementation
-  minAmount: '0.00', // Zero allowed for flexible amounts
-  maxTTL: 600, // seconds
-  minTTL: 60, // seconds
-  defaultTTL: 120, // seconds
-  audience: 'https://payware.eu', // Required JWT audience
-  transactionIdPrefix: 'pw' // All transaction IDs start with 'pw'
-};
-
-/**
- * Generate sandbox configuration
- * @param {string} partnerId - Partner ID
- * @param {string} privateKey - Private key (optional, for validation)
- * @returns {Object} Sandbox configuration object
- */
-export function generateSandboxConfig(partnerId, privateKey = null) {
-  const config = {
-    ...SANDBOX_CONFIG,
-    partnerId,
-    endpoints: {
-      createTransaction: `${SANDBOX_CONFIG.baseUrl}/transactions`,
-      getTransactionStatus: `${SANDBOX_CONFIG.baseUrl}/transactions/{id}`,
-      processTransaction: `${SANDBOX_CONFIG.baseUrl}/transactions/{id}`,
-      cancelTransaction: `${SANDBOX_CONFIG.baseUrl}/transactions/{id}`,
-      getTransactionHistory: `${SANDBOX_CONFIG.baseUrl}/transactions-history/{id}`,
-      callback: 'https://your-callback-url' // Provided by merchant
-    },
-    headers: {
-      'Content-Type': 'application/json',
-      'Api-Version': '1'
-    },
-    authentication: {
-      type: 'JWT',
-      algorithm: 'RS256',
-      audience: 'https://payware.eu',
-      requiresContentMd5: 'For POST/PUT/PATCH requests',
-      hasPrivateKey: !!privateKey
-    },
-    generatedAt: new Date().toISOString()
-  };
-
-  return config;
-}
-
-/**
- * Setup sandbox auth tool implementation  
- */
-export const setupSandboxAuthTool = {
-  name: "payware_authentication_setup_sandbox_auth",
-  description: "Setup sandbox authentication configuration for payware API",
-  inputSchema: {
-    type: "object",
-    properties: {
-      partnerId: {
-        type: "string",
-        description: "Partner ID from payware dashboard. Uses PAYWARE_PARTNER_ID env var as default."
-      },
-      privateKey: {
-        type: "string",
-        description: "RSA private key in PEM format (optional, for validation). Uses environment-specific private key as default."
-      }
-    },
-    additionalProperties: false
-  },
-  
-  async handler(args) {
-    const {
-      partnerId = getPartnerIdSafe(),
-      privateKey = getPrivateKeySafe()
-    } = args;
-
-    if (!partnerId) {
-      throw new Error("Partner ID is required. Provide via 'partnerId' parameter or set PAYWARE_PARTNER_ID environment variable.");
-    }
-    
-    const config = generateSandboxConfig(partnerId, privateKey);
-    
-    return {
-      content: [{
-        type: "text", 
-        text: `🔧 **Sandbox Authentication Setup Complete**
-
-**Configuration:**
-\`\`\`json
-${JSON.stringify(config, null, 2)}
-\`\`\`
-
-**Environment Details:**
-- Base URL: ${config.baseUrl}
-- API Version: ${config.apiVersion}  
-- Environment: ${config.environment}
-- Partner ID: ${config.partnerId}
-
-**Supported Features:**
-- Request Types (trOptions.type): ${config.supportedTransactionTypes.join(', ')}
-- Transaction Types: ${config.transactionTypes.join(', ')}
-- Currencies: ${config.supportedCurrencies.join(', ')} (ISO 3-char codes)
-- Amount Range: €${config.minAmount} - ${config.maxAmount} (currency values)
-- TTL Range: ${config.minTTL}-${config.maxTTL} seconds (default: ${config.defaultTTL})
-- Transaction ID Format: Starts with '${config.transactionIdPrefix}'
-- QR Options: Format (PNG/JPEG/SVG), Border, Error Correction (L/M/Q/H), Scale, Version
-- Barcode Options: Format (CODE128/CODE39/EAN13), Width, Height, Font Size, Text Location
-- Additional: passbackParams for custom callback data
-
-**API Endpoints:**
-- Create Transaction: \`POST ${config.endpoints.createTransaction}\`
-- Get Transaction Status: \`GET ${config.endpoints.getTransactionStatus}\`
-- Process Transaction: \`POST ${config.endpoints.processTransaction}\` (merchants only)
-- Cancel Transaction: \`PATCH ${config.endpoints.cancelTransaction}\` (creators only)
-- Transaction History: \`GET ${config.endpoints.getTransactionHistory}\` (completed/expired)
-- Callback Endpoint: \`POST [your-callback-url]\` (configured by you)
-
-**Required Headers (All Requests):**
-${Object.entries(config.headers).map(([key, value]) => `- ${key}: ${value}`).join('\n')}
-- Authorization: Bearer {JWT_TOKEN} (with contentMd5 for POST/PATCH)
-
-**JWT Requirements:**
-- Algorithm: RS256
-- Issuer (iss): Your Partner ID
-- Audience (aud): https://payware.eu
-- Content-MD5: Required in JWT header for POST/PATCH requests
-- Private Key: RSA 2048-bit minimum
-
-**Required Fields for Transaction Creation:**
-- trData.currency: ISO 3-character code (required)
-- trData.reasonL1: Description, max 100 chars (required)
-- trData.reasonL2: Continuation, max 100 chars (optional)
-- trData.amount: Currency value as string/number, 0.00+ (optional for flexible)
-- trOptions.type: PLAIN, QR, or BARCODE (default: PLAIN)
-- trOptions.timeToLive: 60-600 seconds (default: 120)
-
-**Next Steps:**
-1. Generate RSA key pair (2048-bit minimum)
-2. Register public key in payware portal
-3. Create JWT token with proper structure
-4. Test with create transaction endpoint
-5. Implement callback handler for status updates
-
-**⚠️ Sandbox Only:**
-This configuration is for sandbox testing only. Do not use in production.`
-      }]
-    };
-  }
+/**
+ * Setup sandbox authentication configuration
+ */
+
+import { getPartnerIdSafe, getPrivateKeySafe } from '../config/env.js';
+
+const SANDBOX_CONFIG = {
+  baseUrl: 'https://sandbox.payware.eu/api',
+  apiVersion: '1',
+  environment: 'sandbox',
+  supportedCurrencies: [
+    // Major currencies
+    'EUR', 'USD', 'GBP', 'JPY', 'CHF', 'CAD', 'AUD', 'CNY', 'SEK', 'NOK', 'DKK',
+    // All other supported currencies (100+ total)
+    'AED', 'AFN', 'ALL', 'AMD', 'ANG', 'AOA', 'ARS', 'AWG', 'AZN',
+    'BAM', 'BBD', 'BDT', 'BHD', 'BIF', 'BMD', 'BND', 'BOB', 'BRL', 'BSD', 'BTC', 'BTN', 'BWP', 'BYN', 'BZD',
+    'CDF', 'CLP', 'COP', 'CRC', 'CUP', 'CVE', 'CZK',
+    'DJF', 'DOP', 'DZD',
+    'EGP', 'ERN', 'ETB',
+    'FJD', 'FKP',
+    'GEL', 'GHS', 'GIP', 'GMD', 'GNF', 'GTQ', 'GYD',
+    'HKD', 'HNL', 'HRK', 'HTG', 'HUF',
+    'IDR', 'ILS', 'INR', 'IQD', 'IRR', 'ISK',
+    'JMD', 'JOD',
+    'KES', 'KGS', 'KHR', 'KMF', 'KPW', 'KRW', 'KWD', 'KYD', 'KZT',
+    'LAK', 'LBP', 'LKR', 'LRD', 'LSL', 'LYD',
+    'MAD', 'MDL', 'MGA', 'MKD', 'MMK', 'MNT', 'MOP', 'MRO', 'MUR', 'MVR', 'MWK', 'MXN', 'MYR', 'MZN',
+    'NAD', 'NGN', 'NIO', 'NPR', 'NZD',
+    'OMR',
+    'PAB', 'PEN', 'PGK', 'PHP', 'PKR', 'PLN', 'PYG',
+    'QAR',
+    'RON', 'RSD', 'RUB', 'RWF',
+    'SAR', 'SBD', 'SCR', 'SDG', 'SGD', 'SHP', 'SLL', 'SOS', 'SRD', 'STD', 'SVC', 'SYP', 'SZL',
+    'THB', 'TJS', 'TMT', 'TND', 'TOP', 'TRY', 'TTD', 'TWD', 'TZS',
+    'UAH', 'UGX', 'UYU', 'UZS',
+    'VND', 'VUV',
+    'WST',
+    'XAF', 'XCD', 'XOF', 'XPF',
+    'YER',
+    'ZAR', 'ZMW', 'ZWL'
+  ], // ISO 3-character codes
+  supportedTransactionTypes: ['PLAIN', 'QR', 'BARCODE'], // trOptions.type values
+  transactionTypes: ['DEFAULT', 'SHIPPABLE'], // transactionType values
+  maxAmount: 'Unlimited', // Limited by Java type implementation
+  minAmount: '0.00', // Zero allowed for flexible amounts
+  maxTTL: 600, // seconds
+  minTTL: 60, // seconds
+  defaultTTL: 120, // seconds
+  audience: 'https://payware.eu', // Required JWT audience
+  transactionIdPrefix: 'pw' // All transaction IDs start with 'pw'
+};
+
+/**
+ * Generate sandbox configuration
+ * @param {string} partnerId - Partner ID
+ * @param {string} privateKey - Private key (optional, for validation)
+ * @returns {Object} Sandbox configuration object
+ */
+export function generateSandboxConfig(partnerId, privateKey = null) {
+  const config = {
+    ...SANDBOX_CONFIG,
+    partnerId,
+    endpoints: {
+      createTransaction: `${SANDBOX_CONFIG.baseUrl}/transactions`,
+      getTransactionStatus: `${SANDBOX_CONFIG.baseUrl}/transactions/{id}`,
+      processTransaction: `${SANDBOX_CONFIG.baseUrl}/transactions/{id}`,
+      cancelTransaction: `${SANDBOX_CONFIG.baseUrl}/transactions/{id}`,
+      getTransactionHistory: `${SANDBOX_CONFIG.baseUrl}/transactions-history/{id}`,
+      callback: 'https://your-callback-url' // Provided by merchant
+    },
+    headers: {
+      'Content-Type': 'application/json',
+      'Api-Version': '1'
+    },
+    authentication: {
+      type: 'JWT',
+      algorithm: 'RS256',
+      audience: 'https://payware.eu',
+      requiresContentMd5: 'For POST/PUT/PATCH requests',
+      hasPrivateKey: !!privateKey
+    },
+    generatedAt: new Date().toISOString()
+  };
+
+  return config;
+}
+
+/**
+ * Setup sandbox auth tool implementation  
+ */
+export const setupSandboxAuthTool = {
+  name: "payware_authentication_setup_sandbox_auth",
+  description: "Setup sandbox authentication configuration for payware API",
+  inputSchema: {
+    type: "object",
+    properties: {
+      partnerId: {
+        type: "string",
+        description: "Partner ID from payware dashboard. Uses PAYWARE_PARTNER_ID env var as default."
+      },
+      privateKey: {
+        type: "string",
+        description: "RSA private key in PEM format (optional, for validation). Uses environment-specific private key as default."
+      }
+    },
+    additionalProperties: false
+  },
+  
+  async handler(args) {
+    const {
+      partnerId = getPartnerIdSafe(),
+      privateKey = getPrivateKeySafe()
+    } = args;
+
+    if (!partnerId) {
+      throw new Error("Partner ID is required. Provide via 'partnerId' parameter or set PAYWARE_PARTNER_ID environment variable.");
+    }
+    
+    const config = generateSandboxConfig(partnerId, privateKey);
+    
+    return {
+      content: [{
+        type: "text", 
+        text: `🔧 **Sandbox Authentication Setup Complete**
+
+**Configuration:**
+\`\`\`json
+${JSON.stringify(config, null, 2)}
+\`\`\`
+
+**Environment Details:**
+- Base URL: ${config.baseUrl}
+- API Version: ${config.apiVersion}  
+- Environment: ${config.environment}
+- Partner ID: ${config.partnerId}
+
+**Supported Features:**
+- Request Types (trOptions.type): ${config.supportedTransactionTypes.join(', ')}
+- Transaction Types: ${config.transactionTypes.join(', ')}
+- Currencies: ${config.supportedCurrencies.join(', ')} (ISO 3-char codes)
+- Amount Range: €${config.minAmount} - ${config.maxAmount} (currency values)
+- TTL Range: ${config.minTTL}-${config.maxTTL} seconds (default: ${config.defaultTTL})
+- Transaction ID Format: Starts with '${config.transactionIdPrefix}'
+- QR Options: Format (PNG/JPEG/SVG), Border, Error Correction (L/M/Q/H), Scale, Version
+- Barcode Options: Format (CODE128/CODE39/EAN13), Width, Height, Font Size, Text Location
+- Additional: passbackParams for custom callback data
+
+**API Endpoints:**
+- Create Transaction: \`POST ${config.endpoints.createTransaction}\`
+- Get Transaction Status: \`GET ${config.endpoints.getTransactionStatus}\`
+- Process Transaction: \`POST ${config.endpoints.processTransaction}\` (merchants only)
+- Cancel Transaction: \`PATCH ${config.endpoints.cancelTransaction}\` (creators only)
+- Transaction History: \`GET ${config.endpoints.getTransactionHistory}\` (completed/expired)
+- Callback Endpoint: \`POST [your-callback-url]\` (configured by you)
+
+**Required Headers (All Requests):**
+${Object.entries(config.headers).map(([key, value]) => `- ${key}: ${value}`).join('\n')}
+- Authorization: Bearer {JWT_TOKEN} (with contentSha256 for POST/PATCH)
+
+**JWT Requirements:**
+- Algorithm: RS256
+- Issuer (iss): Your Partner ID
+- Audience (aud): https://payware.eu
+- Content-SHA256: Required in JWT header for POST/PATCH requests
+- Private Key: RSA 2048-bit minimum
+
+**Required Fields for Transaction Creation:**
+- trData.currency: ISO 3-character code (required)
+- trData.reasonL1: Description, max 100 chars (required)
+- trData.reasonL2: Continuation, max 100 chars (optional)
+- trData.amount: Currency value as string/number, 0.00+ (optional for flexible)
+- trOptions.type: PLAIN, QR, or BARCODE (default: PLAIN)
+- trOptions.timeToLive: 60-600 seconds (default: 120)
+
+**Next Steps:**
+1. Generate RSA key pair (2048-bit minimum)
+2. Register public key in payware portal
+3. Create JWT token with proper structure
+4. Test with create transaction endpoint
+5. Implement callback handler for status updates
+
+**⚠️ Sandbox Only:**
+This configuration is for sandbox testing only. Do not use in production.`
+      }]
+    };
+  }
 };