> For the complete documentation index, see [llms.txt](https://developers.doku.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://developers.doku.com/get-started-with-doku-api/signature-component/snap/asymmetric-signature.md).

# Asymmetric Signature

{% hint style="warning" %}
Please Note 

stringToSign component for Get Token and Transactional will be different!

1. For Get Token = `stringToSign` = `client_ID + “|” + X- TIMESTAMP`
2. For Transactional = `stringToSign` = `HTTPMethod +":"+ EndpointUrl +":"+ Lowercase(HexEncode(SHA256(minify(RequestBody)))) + ":" + TimeStamp`
   {% endhint %}

### **Preparation**

Before generating `Signature`, merchant need to prepare all the component required.

| Name           | Description                                                                                                                                                                                                                                                                                                                                                                                                   |
| -------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `privateKey`   | <p>Merchant privateKey <br>How to generate : </p><ol><li>generate private key RSA : <em>openssl genrsa -out private.key 2048</em></li><li>set passphrase your private key RSA : <em>openssl pkcs8 -topk8 -inform PEM -outform PEM -in private.key -out pkcs8.key -v1 PBE-SHA1-3DES</em></li><li>generate public key RSA : <em>openssl rsa -in private.key -outform PEM -pubout -out public.pem</em></li></ol> |
| `HTTPMethod`   | The HTTP method that client use to hit the API                                                                                                                                                                                                                                                                                                                                                                |
| `endpointURL`  | <p>The path of the endpoint that will be hitted e.g:  <code>/bi-snap-va/v1/transfer-va/create-va</code><br><br><strong>NOTE:</strong> For the <code>HTTP Notification</code> from DOKU to merchant server, this will be the path of merchant <code>Notification URL</code>. As for the <code>Inquiry Request</code>, this will be the path of merchant <code>Inquiry URL</code></p>                           |
| `Timestamp`    | Same with `X-TIMESTAMP`                                                                                                                                                                                                                                                                                                                                                                                       |
| `stringToSign` | `HTTPMethod +":"+ EndpointUrl +":"+ Lowercase(HexEncode(SHA256(minify(RequestBody)))) + ":" + TimeStamp`                                                                                                                                                                                                                                                                                                      |

**Set stringToSign Component**

1. Minify request Body&#x20;

<table><thead><tr><th>Before</th><th>After</th></tr></thead><tbody><tr><td><p></p><pre class="language-json"><code class="lang-json">{
   "partnerServiceId":"  088899",
   "customerNo":"12345678901234567890",
   "virtualAccountNo":"  08889912345678901234567890",
   "virtualAccountName":"Jokul Doe",
   "virtualAccountEmail":"jokul@email.com",
   "virtualAccountPhone":"6281828384858",
   "trxId":"abcdefgh1234",
   "totalAmount":{
      "value":"12345678.00",
      "currency":"IDR"
   }
}
</code></pre></td><td><p></p><pre class="language-json"><code class="lang-json">{"partnerServiceId":"  088899","customerNo":"12345678901234567890","virtualAccountNo":"  08889912345678901234567890","virtualAccountName":"Jokul Doe","virtualAccountEmail":"jokul@email.com","virtualAccountPhone":"6281828384858","trxId":"abcdefgh1234","totalAmount":{"value":"12345678.00","currency":"IDR"}}
</code></pre></td></tr></tbody></table>

2. Calculate the result of {minify-request-body}  using SHA-256

The result will be like this :&#x20;

```json
3274fab8dac896837b106a16da2a974e7e65142dcecb4b768ef0294102838977
```

3. Hexencode the result of {SHA-256(minify-request-body)}

The result will be like this :&#x20;

3274fab8dac896837b106a16da2a974e7e65142dcecb4b768ef0294102838977

4. Set the result of hexencode{SHA-256(minify-request-body)} to Lowercase [**​**](https://dashboard.doku.com/docs/docs/technical-references/generate-signature#set-client-id-request-id-request-timestamp)

#### Generating StringtoSign

This is the formula for generating the string to Sign :&#x20;

`HTTPMethod +”:“+ EndpointUrl +":“+ Lowercase(HexEncode(SHA256(minify(RequestBody)))) + ":“ + TimeStamp`

{% hint style="info" %}
What is `endpointURL` ?&#x20;

`endpointURL` means Request Target.&#x20;

The Request-Target is depending on who is sending the request:

1. **When merchant hits DOKU endpoints:** The Request-Target is the path of the DOKU API that merchant hits.\
   For instance, if merchant wants to hit DOKU VA API: `https://api.doku.com/`bi-snap-va/v1/transfer-va/create-va. Therefore, the Request-Target value is  /bi-snap-va/v1/transfer-va/create-va
2. **When DOKU hits merchant endpoints (HTTP Notification / Inquiry Request):** The Request-Target is the path of merchant `Notification URL` or the `Inquiry URL`.\
   For instance, if merchant set the `Notification URL`: `https://yourdomain.com/payments/notifications`. Therefore, the Request-Target value is `/payments/notifications`.
   {% endhint %}

### Generate Signature :&#x20;

After all the `stringToSign` component has been set,  merchant can now generate the signature :&#x20;

1. Calculate the result of `(privateKey , stringToSign)` using *SHA256withRSA*&#x20;

   Ex : `qd2m9ot+cfq48qJ68+8IYdfkNDMA2hhecM2XegsnZ1Z5Fur9zii8BVm6cI7g1gyhL5/+OFZqAO8Kp0XPMdipfg==`
2. Put the value to each API in X-Signature component in Request Header