Every request towards Kitopay API must contain the following headers:
x-merchant-id - the id of the merchant that you can find in the Dashboard
x-signature - the request signature generated using HMAC-SHA256 (check the section for more details)
x-timestamp - UNIX timestamp of the request . If x-timestamp differs from the server time by more than 60 seconds the request will be considered expired.
Signature generation
x-signature
To generate the digital signature using Hash-based Message Authentication Code (HMAC-SHA256), you need to use the request URL, body, method, merchant id and timestamp. The whole algorithm is outlined below:
Combine the merchant id, x-timestamp header value (request timestamp), method, the entire request URL with query string parameters and request body without any delimiters. You can find the example below.
Use the HMAC-SHA256 algorithm with the secret key retrieved in the dashboard to get the hash of the string generated in the 1st step. Data must be encoded using UTF8 while computing the hash.
The resulting hash is the signature that you need to pass in the x-signature header for this API request.
You can use the example provided below to check if your integration is correct.
Signature generation example
You should use the request body, x-timestamp and x-merchant-id headers values for signature generation. The payload, timestamp and merchant id used for signature generation must be 100% the same as the payload and headers sent in the request.
It is important to use the exact payload that will be sent in the request. If you use a formatted ("pretty") JSON for signature generation and then automatically minify or escape the JSON in the request, signature validation will fail.
One of the most common integration issues you can face is a trailing slash error (missing or extra trailing slash). Please make sure to use the exact URL that you will be sending the request to in the payload for signature generation.
We'll use the following x-timestamp, x-merchant-id and secret key values in the example below:
To generate the digital signature using Hash-based Message Authentication Code (HMAC-SHA256), you only need to use the merchant id, timestamp and transaction id (full request body is not required). The whole algorithm is outlined below:
Combine the merchant id, x-timestamp header value (request timestamp), method and transaction id (payin/payout id). You can find the example below.
Use the HMAC-SHA256 algorithm with the secret key retrieved in the dashboard to get the hash of the string generated in the 1st step. Data must be encoded using UTF8 while computing the hash.
The resulting hash is the signature that you need to pass in the x-simplified-signature header for this API request.
You can use the example provided below to check if your integration is correct.
Signature generation example
We'll use the following x-timestamp, x-merchant-id and secret key values in the example below:
