Signature Rule

To ensure secure communication between your application and our API, all requests must be signed using your unique signing_secret set on your merchant dashboard.
This signature allows our system to verify that the request truly originated from you and has not been tampered with.

How Signature Verification Works

Each request sent to our API should include a signature generated using your signing secret in the request header as X-Signature.
On our end, we recompute the signature and compare it to the one you sent.

If they don’t match, the request is rejected with an Invalid signature error.

Example Code (Server-side Verification)

<?php

$payload = [
    'amount' => 5000,
    'currency' => 'USD',
    'order_id' => '12345'
];

$data = json_encode($payload) . "/api/orders/create";
$signature = hash_hmac('sha512', $data, $signing_secret);

$ch = curl_init('https://api.example.com/api/orders/create');
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_HTTPHEADER, [
    'Content-Type: application/json',
    'X-Signature: ' . $signature,
]);
curl_setopt($ch, CURLOPT_POSTFIELDS, json_encode($payload));
$response = curl_exec($ch);
curl_close($ch);

const crypto = require('crypto');

const payload = JSON.stringify({ amount: 5000, currency: 'USD' });
const path = '/api/orders/create';
const data = payload + path;

const signature = crypto
  .createHmac('sha512', process.env.SIGNING_SECRET)
  .update(data)
  .digest('hex');

console.log(signature);

import hashlib, hmac, json

payload = {"amount": 5000, "currency": "USD"}
data = json.dumps(payload) + "/api/orders/create"
signature = hmac.new(
    b"your_signing_secret_here",
    data.encode("utf-8"),
    hashlib.sha512
).hexdigest()

print(signature)