Signature Generation
Test on PostmanTo ensure the security of transactions, iPaymu requires a signature header in every API request.
To ensure the security of transactions, iPaymu requires a signature header in every API request. This signature is generated using your API Key and request details.
How to Generate Signature
The signature is generated using HMAC-SHA256 hashing.
Formula
String to Sign = Method + ":" + VA + ":" + RequestBody + ":" + APIKey
Signature = HMAC-SHA256(String to Sign, APIKey)Components
- Method: HTTP Method (e.g.,
GET,POST). - VA: Your Virtual Account Number.
- RequestBody:
- For GET requests: The JSON stringified query parameters.
- For POST requests: The SHA256 hash of the JSON body.
- APIKey: Your iPaymu API Key.
Example Implementation
const crypto = require('crypto-js');
// Configuration
const apiKey = 'YOUR_API_KEY';
const va = 'YOUR_VA';
const method = 'POST'; // or 'GET'
// For POST Request Body
const body = {
product: ['T-Shirt'],
qty: ['1'],
price: ['100000'],
returnUrl: 'https://your-website.com/thank-you',
notifyUrl: 'https://your-website.com/notify',
cancelUrl: 'https://your-website.com/cancel',
referenceId: 'ID1234'
};
// 1. Stringify the body
const bodyJson = JSON.stringify(body);
// 2. Hash the body (SHA256)
const bodyHash = crypto.SHA256(bodyJson).toString(crypto.enc.Hex);
// 3. Construct String to Sign
const stringToSign = `${method}:${va}:${bodyHash}:${apiKey}`;
// 4. Generate Signature (HMAC-SHA256)
const signature = crypto.HmacSHA256(stringToSign, apiKey).toString(crypto.enc.Hex);
console.log('Signature:', signature);✓
Ensure that the order of parameters in your JSON body matches exactly what you send in the request. It is recommended to sort keys alphabetically if your JSON serializer does not guarantee order, although iPaymu typically expects the raw string used in the request body.
Using the Signature
Once generated, include the signature in your request header:
signature: <generated_signature>
va: <your_va>
timestamp: <current_timestamp>