Request Signature Authentication

Each API request must include the standard authentication headers:

• X-Api-Key-Id
• X-Signature
• X-Timestamp

The X-Signature value is generated from the HTTP method, request path, raw request body, and Unix timestamp.

Signature Base String

Build the signature base string by concatenating these values without separators:

1. HTTP method.
2. Request path without the scheme, host, or query string.
3. Raw request body. For requests without a body, use an empty string.
4. Unix epoch timestamp in seconds.

HTTP_METHOD + PATH + requestBody + timestamp

For URLs with query parameters, keep those parameters in the actual request URL, but do not include them in the PATH value used for signature generation.

Example

For this request:

POST /api/v1/orders/payin HTTP/1.1
X-Api-Key-Id: 3fa85f64-5717-4562-b3fc-2c963f66afa6
X-Timestamp: 1234567
Content-Type: application/json
Accept: application/json

{"reference_id":"merchant-order-12345","currency":"USD","amount":100.00}

The signature base string is:

POST/api/v1/orders/payin{"reference_id":"merchant-order-12345","currency":"USD","amount":100.00}1234567

Generated Headers

X-Api-Key-Id: 3fa85f64-5717-4562-b3fc-2c963f66afa6
X-Signature: <generated-signature>
X-Timestamp: 1234567

Postman Example

Use a pre-request script to build the signature from the current request.

const secret = "secretKey";
const timestamp = Math.floor(Date.now() / 1000).toString();
const method = pm.request.method.replace(" ", "");
const path = "/" + pm.request.url.path.join("/");
const body = pm.request.body?.raw || "";
const baseString = method + path + body + timestamp;

const signature = CryptoJS
  .HmacSHA512(baseString, secret)
  .toString(CryptoJS.enc.Base64);

pm.request.headers.upsert({
  key: "X-Timestamp",
  value: timestamp
});

pm.request.headers.upsert({
  key: "X-Signature",
  value: signature
});