Authentication & Request Signing

METHOD
PATH
QUERY_STRING
TIMESTAMP
NONCE
BODY_SHA256

POST
/v1/payments
currency=USD
1716501000
b4d9a2a1-9c2b-4df4-8b8e-2a13a45fd321
4e07408562bedb8b60ce05c1decfe3ad16b722309a7c4c5f64b1f4e48e8d8d69

HMAC-SHA256

Base64

signature = Base64(
    HMAC_SHA256(api_secret, canonical_string)
)

X-Signature: v1=<signature>

const API_KEY = pm.environment.get("API_KEY");
const API_SECRET = (pm.environment.get("API_SECRET") || "").trim();

async function hmacSha256Base64(key, msg) {
    const enc = new TextEncoder();
    const cryptoKey = await crypto.subtle.importKey(
        "raw",
        enc.encode(key),
        {name: "HMAC", hash: "SHA-256"},
        false,
        ["sign"]
    );

    const sig = await crypto.subtle.sign("HMAC", cryptoKey, enc.encode(msg));
    return btoa(String.fromCharCode(...new Uint8Array(sig)));
}

function sha256Hex(str) {
    return CryptoJS.SHA256(str).toString(CryptoJS.enc.Hex);
}

const method = pm.request.method.toUpperCase();
const path = pm.request.url.getPath();
const query = pm.request.url.getQueryString() || "";
const body = pm.request.body?.raw || "";

const bodyHash = sha256Hex(body);
const timestamp = Math.floor(Date.now() / 1000).toString();
const nonce = crypto.randomUUID();

const canonical = [
    method,
    path,
    query,
    timestamp,
    nonce,
    bodyHash
].join("\n");

const signature = await hmacSha256Base64(API_SECRET, canonical);

pm.request.headers.upsert({key: "X-API-Key", value: API_KEY});
pm.request.headers.upsert({key: "X-Timestamp", value: timestamp});
pm.request.headers.upsert({key: "X-Nonce", value: nonce});
pm.request.headers.upsert({key: "X-Signature", value: `v1=${signature}`});

192.168.1.0/24
203.0.113.45/32

{
  "code": 20002,
  "payload": null,
  "error": {
    "message": "Bad signature",
    "details": {
      "reason": "signature_mismatch"
    }
  },
  "request_id": "req_xxx"
}

{
  "code": 40001,
  "payload": null,
  "error": {
    "message": "Rate limit exceeded",
    "details": {
      "retry_after": "55 seconds"
    }
  },
  "request_id": "req_xxx"
}