> For the complete documentation index, see [llms.txt](https://developers.doku.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://developers.doku.com/get-started-with-doku-api/signature-component/non-snap/signature-component-from-request-header.md).

# Signature Component from Request Header

```markup
Client-Id:value
Request-Id:value
Request-Timestamp:value
Request-Target:value
Digest:value
```

#### **Component Explanation**

<table><thead><tr><th width="214">Name</th><th></th></tr></thead><tbody><tr><td>C<code>lient-id</code></td><td>Retrieved from the Request Header</td></tr><tr><td>R<code>equest-id</code></td><td>Retrieved from the Request Header</td></tr><tr><td><code>Request-Timestamp</code></td><td>Retrieved from the Request Header</td></tr><tr><td><code>Request-Target</code></td><td>The path of the endpoint that will be hitted e.g: <code>/doku-virtual-account/v2/payment-code</code>. <strong>NOTE:</strong> For the <code>HTTP Notification</code> from DOKU to merchant server, this will be the path of merchant <code>Notification URL</code>. As for the <code>Inquiry Request</code>, this will be the path of merchant <code>Inquiry URL</code></td></tr><tr><td><code>Digest</code></td><td>Encoded (base64) value of hashed (SHA-256) JSON body. This component only applied for <code>POST</code> Method.</td></tr></tbody></table>

### **Preparation**

Before generating `Signature`, merchant need to prepare all the component required.

**Set Client-Id, Request-Id, Request-Timestamp.**[**​**](https://dashboard.doku.com/docs/docs/technical-references/generate-signature#set-client-id-request-id-request-timestamp)

Use the Client-Id, Request-Id, Request-Timestamp that is placed on the Request Header.

**Set Request-Target**[**​**](https://dashboard.doku.com/docs/docs/technical-references/generate-signature#set-request-target)

The Request-Target is depending on who is sending the request:

1. **When merchant hits DOKU endpoints:** The Request-Target is the path of the DOKU API that merchant hits.\
   For instance, if merchant wants to hit DOKU VA API: `https://api.doku.com/doku-virtual-account/v2/payment-code`. Therefore, the Request-Target value is `/doku-virtual-account/v2/payment-code`.
2. **When DOKU hits merchant endpoints (HTTP Notification / Inquiry Request):** The Request-Target is the path of merchant `Notification URL` or the `Inquiry URL`.\
   For instance, if merchant set the `Notification URL`: `https://yourdomain.com/payments/notifications`. Therefore, the Request-Target value is `/payments/notifications`.

#### **Generate Digest**

`Digest` is the hashed of the request body. To generate the `Digest`:

1. Calculate SHA256 base64 hash from the JSON Body

### Generating Signature[​](https://dashboard.doku.com/docs/docs/technical-references/generate-signature#generating-signature)

After all the `Signature` component has been set, merchant can now generate it:

1. Arrange the signature components to one component and its value per line by adding  escape character. Don't add  at the end of the string. Sample of the raw format:

```html
Client-Id:MCH-0001-10791114622547\nRequest-Id:cc682442-6c22-493e-8121-b9ef6b3fa728\nRequest-Timestamp:2020-08-11T08:45:42Z\nRequest-Target:/doku-virtual-account/v2/payment-code\nDigest:5WIYK2TJg6iiZ0d5v4IXSR0EkYEkYOezJIma3Ufli5s=
```

This is how merchant see it:

```html
Client-Id:MCH-0001-10791114622547
Request-Id:cc682442-6c22-493e-8121-b9ef6b3fa728
Request-Timestamp:2020-08-11T08:45:42Z
Request-Target:/doku-virtual-account/v2/payment-code
Digest:5WIYK2TJg6iiZ0d5v4IXSR0EkYEkYOezJIma3Ufli5s=
```

2. Calculate HMAC-SHA256 base64 from all the components above using the [Secret Key from DOKU Back Office](https://dashboard.doku.com/docs/docs/getting-started/retrieve-credential)
3. Put encoded value and prepend `HMACSHA256=` to the `Signature`. Sample:

```html
Signature: HMACSHA256=OvIRJs/jH8BIcGsktr4d8nnYtxY6E0Uzdm9d1GVgv5s=
```