Authentication & signature

All merchant REST requests and webhook signature verification share the same HMAC model.
Updated: 2026-08-05

Request headers (Merchant → BPN)

Header	Required	Notes	Example
`API-KEY`	Yes	Merchant apiKey	`ak_live_xxx`
`API-TIMESTAMP`	Yes	Unix epoch milliseconds	`1690000000000`
`API-SIGNATURE`	Yes	Algorithm below	`a1b2c3...`
`Content-Type`	Required for POST	`application/json`

message   = compactJson(body) + "&" + timestampMillis
signature = HEX_LOWER( HMAC_SHA256( key = apiSecret(UTF-8), message ) )

For GET with no body, treat compactJson(body) as an empty string.

compactJson: JSON serialization without insignificant whitespace; field order must match the body bytes you actually send.

Large clock skew fails verification — keep NTP sync.

When you receive a callback, verify API-SIGNATURE with the same algorithm. See Webhooks Overview.