> For the complete documentation index, see [llms.txt](https://passimpay.gitbook.io/passimpay-api/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://passimpay.gitbook.io/passimpay-api/example-of-a-signature.md).

# Example of a signature

How to generate signatures?

#### Security

All the communication against and from our API will be signed and the signature must be included as header. This signature allows us to certificate data integrity within the communication.

### Prerequisites

{% tabs %}
{% tab title="Java" %}

```java
Integer platformId = "50"; //your platform ID
String secret = "your-api-key";

JSONObject body = new JSONObject();
body.put("orderId", "your-transaction-identifier");
body.put("paymentId", 90);
body.put("amount", "100.00");
body.put("platformId", 50); //your platform ID
```

{% endtab %}

{% tab title="Python" %}

```python
platformId = 50 # your platform ID
secret = 'your-api-key'
body = {
    "orderId": "your-transaction-identifier",
    "paymentId": 90,
    "amount": "100.00",
    "platformId": 50 # your platform ID
}
```

{% endtab %}

{% tab title="PHP" %}

```php
$platformId = 50; //your platform ID
$secret = 'your-api-key';
$body = [
    "orderId" => "your-transaction-identifier",
    "paymentId" => 90,
    "amount" => "100.00",
    "platformId" => $platformId //your platform ID
];
```

{% endtab %}

{% tab title="JS" %}

```
const platformId = 50; //your platform ID
const secret = "your-api-key";
const body = {
  orderId: "your-transaction-identifier",
  paymentId: 90,
  amount: "100.00",
  platformId: 50, //your platform ID
};

```

<br>
{% endtab %}

{% tab title="C#" %}

```
int platformId = 0;
string secret = "000000-000000-000000-000000-000000"; 
var body = new
{
    orderId = "d2671b51-b04d-444e-a2ab-306b4bc95038_87",
    amount = "10.00",
    symbol = "USD",
    type = 1,
    returnUrl = "https://localhost:7158/de/customer/paymentpending?paymentId=87",
    platformId = 0
};
```

{% endtab %}
{% endtabs %}

**Note: The previous body is an example, since it is dynamic and the signature can change according to the body of the request or response.**

#### **Step 1 - Create signature.**

{% tabs %}
{% tab title="Java" %}

<pre class="language-java"><code class="lang-java"><strong>    ...
</strong><strong>    ObjectMapper objectMapper = new ObjectMapper();
</strong>    String bodyJson = objectMapper.writeValueAsString(body);
    String signatureContract = platformId + ";" + bodyJson + ";" + secret;
    String signature = generateSignature(signatureContract, secret);
    ...
    
// Helper function to generate HMAC-SHA256 signature
private String generateSignature(String signatureContract, String secret) throws NoSuchAlgorithmException, InvalidKeyException {
    Mac sha256HMAC = Mac.getInstance("HmacSHA256");
    SecretKeySpec secretKey = new SecretKeySpec(secret.getBytes(StandardCharsets.UTF_8), "HmacSHA256");
    sha256HMAC.init(secretKey);
    byte[] hash = sha256HMAC.doFinal(signatureContract.getBytes(StandardCharsets.UTF_8));
    StringBuilder result = new StringBuilder();
    for (byte b : hash) {
        result.append(String.format("%02x", b));
    }
    return result.toString();
}
    
</code></pre>

{% endtab %}

{% tab title="Python" %}

```python
serialized_body = json.dumps(body, separators=(',', ':'), ensure_ascii=False)
signature_contract = f"{platformId};{serialized_body};{secret}"
signature = hmac.new(secret.encode(), signature_contract.encode(), hashlib.sha256).hexdigest()
```

{% endtab %}

{% tab title="PHP" %}

```php
$signatureContract = $platformId .";". json_encode($body) .";". $secret;
$signature = hash_hmac('sha256', $signatureContract, $secret);
```

{% endtab %}

{% tab title="JS" %}

```
const serializedBody = JSON.stringify(body).replace(///g, "\/");
const signatureContract = `${platformId};${serializedBody};${secret}`;
const signature = crypto.createHmac("sha256", secret).update(signatureContract).digest("hex");
```

{% endtab %}

{% tab title="C#" %}

```
string jsonBody = JsonSerializer.Serialize(body);
string jsonBodyFixed = jsonBody.Replace("/", "\\/");
string signatureContract = $"{platformId};{jsonBodyFixed};{secret}";

using var hmac = new HMACSHA256(Encoding.UTF8.GetBytes(secret));
byte[] hashBytes = hmac.ComputeHash(Encoding.UTF8.GetBytes(signatureContract));
string signature = BitConverter.ToString(hashBytes).Replace("-", "").ToLower();

```

{% endtab %}
{% endtabs %}

#### **Step 2 - Execution of the Request**

{% tabs %}
{% tab title="Java" %}

```java
String signature = "your-signature";  // Replace with the generated signature

// Open connection
HttpURLConnection conn = (HttpURLConnection) url.openConnection();
conn.setRequestMethod("POST");
conn.setConnectTimeout(10000); // 10 seconds timeout
conn.setReadTimeout(10000);
conn.setDoOutput(true);  // Allow sending data

// Set headers
conn.setRequestProperty("Content-Type", "application/json");
conn.setRequestProperty("x-signature", signature);

// Send the request body
try (OutputStream os = conn.getOutputStream()) {
    byte[] input = jsonBody.getBytes(StandardCharsets.UTF_8);
    os.write(input, 0, input.length);
}

// Get response code
int responseCode = conn.getResponseCode();

// Read the response
BufferedReader br;
if (responseCode == HttpURLConnection.HTTP_OK) {
    br = new BufferedReader(new InputStreamReader(conn.getInputStream(), StandardCharsets.UTF_8));
} else {
    br = new BufferedReader(new InputStreamReader(conn.getErrorStream(), StandardCharsets.UTF_8));
}

StringBuilder response = new StringBuilder();
String responseLine;
while ((responseLine = br.readLine()) != null) {
    response.append(responseLine.trim());
}

// Close connection
conn.disconnect();

// Parse JSON response (if needed)
Map<String, Object> result = objectMapper.readValue(response.toString(), Map.class);

// Print result
System.out.println(result);
```

{% endtab %}

{% tab title="Python" %}

```python
import json
import requests

body_json = json.dumps(body)

headers = {
    'Content-Type': 'application/json',
    'x-signature': 'your_signature',  # Replace with the actual signature
}

# Send the POST request
url = 'https://api.passimpay.io/v2/currencies'
try:
    response = requests.post(url, headers=headers, data=body_json, timeout=10)

    # Get the HTTP status code
    http_code = response.status_code

    # Parse the JSON response
    result = response.json()
    
    print(f'Response: {result}')
except requests.exceptions.RequestException as e:
    print(f'An error occurred: {e}')
```

{% endtab %}

{% tab title="PHP" %}

```php
$body = json_encode($body);
$headers = [
    'Content-Type: application/json',
    'x-signature: ' . $signature,
];
$curl = curl_init();
curl_setopt($curl, CURLOPT_POSTFIELDS, $body);
curl_setopt($curl, CURLOPT_POST, true); 
curl_setopt($curl, CURLOPT_HTTPHEADER, $headers); 
curl_setopt($curl, CURLOPT_CONNECTTIMEOUT, 10); 
curl_setopt($curl, CURLOPT_RETURNTRANSFER, true); 
curl_setopt($curl, CURLOPT_URL, 'https://api.passimpay.io/v2/currencies');
curl_setopt($curl, CURLOPT_FOLLOWLOCATION, true);
$result = curl_exec($curl); 
$httpCode = curl_getinfo($curl, CURLINFO_HTTP_CODE); 
curl_close($curl); 

$result = json_decode($result, true);

print_r($result);
```

{% endtab %}

{% tab title="JS" %}

```
try {
    const response = await axios({
        method: "POST",
        url: "https://api.passimpay.io/v2/currencies",
        headers: {
            "Content-Type": "application/json",
            'x-signature': signature
        },
        data: body,
    });
    console.log(response.data);
} catch (error: any) {
    console.error(error);
}
```

{% endtab %}

{% tab title="C#" %}

```
using var httpClient = new HttpClient();

try
{
    httpClient.DefaultRequestHeaders.Add("x-signature", signature);
    httpClient.Timeout = TimeSpan.FromSeconds(10);

    var content = new StringContent(jsonBody, Encoding.UTF8, "application/json");

    HttpResponseMessage response = await httpClient.PostAsync("https://api.passimpay.io/v2/currencies", content);

    int httpCode = (int)response.StatusCode;

    string resultContent = await response.Content.ReadAsStringAsync();

    var result = JsonSerializer.Deserialize<object>(resultContent);

    Console.WriteLine($"HTTP Code: {httpCode}");
    Console.WriteLine("Response:");
    Console.WriteLine(JsonSerializer.Serialize(result, new JsonSerializerOptions { WriteIndented = true }));
}
catch (Exception ex)
{
    Console.WriteLine($"Error: {ex.Message}");
}

```

{% endtab %}
{% endtabs %}

**Signature use cases:**

1. When you call us, you should send the `x-signature` header, so we can validate the payload data integrity.
2. When you receive a response, you must validate the `x-signature` header presence and validate that it is valid.
3. When you receive a callback, you must validate the `x-signature` header presence and validate that it is valid.

**Postman create signature Pre-request Script:**

{% code fullWidth="false" %}

```
const crypto = require('crypto-js');

try {
    const platformId = 0;
    const secret = '000000-000000-000000-000000-000000';

    if (!platformId || !secret) {
        throw new Error('Missing required environment variables: platform_id or api_secret');
    }

    const requestBody = pm.request.body.raw;
    let bodyJson;

    if (requestBody) {
        try {
            bodyJson = JSON.parse(requestBody);
        } catch (e) {
            throw new Error('Invalid JSON in request body');
        }
    } else {
        bodyJson = {};
    }

    const signatureContract = `${platformId};${JSON.stringify(bodyJson).replace(/\//g, "\\/")};${secret}`;

    const signature = crypto.HmacSHA256(signatureContract, secret).toString();

    pm.request.headers.add({
        key: 'x-signature',
        value: signature
    });

} catch (error) {
    console.error('Error in pre-request script:', error.message);
    pm.environment.set('signature_error', error.message);
}

```

{% endcode %}