# Signature Component from Request Header

```markup
Client-Id:value
Request-Id:value
Request-Timestamp:value
Request-Target:value
Digest:value
```

#### **Component Explanation**

<table><thead><tr><th width="214">Name</th><th></th></tr></thead><tbody><tr><td>C<code>lient-id</code></td><td>Retrieved from the Request Header</td></tr><tr><td>R<code>equest-id</code></td><td>Retrieved from the Request Header</td></tr><tr><td><code>Request-Timestamp</code></td><td>Retrieved from the Request Header</td></tr><tr><td><code>Request-Target</code></td><td>The path of the endpoint that will be hitted e.g: <code>/doku-virtual-account/v2/payment-code</code>. <strong>NOTE:</strong> For the <code>HTTP Notification</code> from DOKU to merchant server, this will be the path of merchant <code>Notification URL</code>. As for the <code>Inquiry Request</code>, this will be the path of merchant <code>Inquiry URL</code></td></tr><tr><td><code>Digest</code></td><td>Encoded (base64) value of hashed (SHA-256) JSON body. This component only applied for <code>POST</code> Method.</td></tr></tbody></table>

### **Preparation**

Before generating `Signature`, merchant need to prepare all the component required.

**Set Client-Id, Request-Id, Request-Timestamp.**[**​**](https://dashboard.doku.com/docs/docs/technical-references/generate-signature#set-client-id-request-id-request-timestamp)

Use the Client-Id, Request-Id, Request-Timestamp that is placed on the Request Header.

**Set Request-Target**[**​**](https://dashboard.doku.com/docs/docs/technical-references/generate-signature#set-request-target)

The Request-Target is depending on who is sending the request:

1. **When merchant hits DOKU endpoints:** The Request-Target is the path of the DOKU API that merchant hits.\
   For instance, if merchant wants to hit DOKU VA API: `https://api.doku.com/doku-virtual-account/v2/payment-code`. Therefore, the Request-Target value is `/doku-virtual-account/v2/payment-code`.
2. **When DOKU hits merchant endpoints (HTTP Notification / Inquiry Request):** The Request-Target is the path of merchant `Notification URL` or the `Inquiry URL`.\
   For instance, if merchant set the `Notification URL`: `https://yourdomain.com/payments/notifications`. Therefore, the Request-Target value is `/payments/notifications`.

#### **Generate Digest**

`Digest` is the hashed of the request body. To generate the `Digest`:

1. Calculate SHA256 base64 hash from the JSON Body

### Generating Signature[​](https://dashboard.doku.com/docs/docs/technical-references/generate-signature#generating-signature)

After all the `Signature` component has been set, merchant can now generate it:

1. Arrange the signature components to one component and its value per line by adding  escape character. Don't add  at the end of the string. Sample of the raw format:

```html
Client-Id:MCH-0001-10791114622547\nRequest-Id:cc682442-6c22-493e-8121-b9ef6b3fa728\nRequest-Timestamp:2020-08-11T08:45:42Z\nRequest-Target:/doku-virtual-account/v2/payment-code\nDigest:5WIYK2TJg6iiZ0d5v4IXSR0EkYEkYOezJIma3Ufli5s=
```

This is how merchant see it:

```html
Client-Id:MCH-0001-10791114622547
Request-Id:cc682442-6c22-493e-8121-b9ef6b3fa728
Request-Timestamp:2020-08-11T08:45:42Z
Request-Target:/doku-virtual-account/v2/payment-code
Digest:5WIYK2TJg6iiZ0d5v4IXSR0EkYEkYOezJIma3Ufli5s=
```

2. Calculate HMAC-SHA256 base64 from all the components above using the [Secret Key from DOKU Back Office](https://dashboard.doku.com/docs/docs/getting-started/retrieve-credential)
3. Put encoded value and prepend `HMACSHA256=` to the `Signature`. Sample:

```html
Signature: HMACSHA256=OvIRJs/jH8BIcGsktr4d8nnYtxY6E0Uzdm9d1GVgv5s=
```


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://developers.doku.com/get-started-with-doku-api/signature-component/non-snap/signature-component-from-request-header.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.