Symmetric Signature
Symmetric Signature
Preparation
Before generating Signature
, merchant need to prepare all the component required.
Component Explanation
Name | Description |
---|---|
| |
| The HTTP method that client use to hit the API |
| The path of the endpoint that will be hitted e.g: |
| Result of get token B2B ( without Bearer ) |
| Same with |
|
|
How to generate stringToSign Component
Minify request Body
Before | After |
---|---|
Calculate the result of {minify-request-body} using SHA-256
The result will be like this :
Hexencode the result of {SHA-256(minify-request-body)}
The result will be like this :
3274fab8dac896837b106a16da2a974e7e65142dcecb4b768ef0294102838977
Set the result of hexencode{SHA-256(minify-request-body)} to Lowercase
Generating StringtoSign
This is the formula for generating the string to Sign :
HTTPMethod +”:“+ EndpointUrl +":"+ AccessToken +":“+ Lowercase(HexEncode(SHA256(minify(RequestBody))))+ ":“ + TimeStamp
This is the sample of stringToSign = __TEC2O1iVBszTBTkrZhCujPRwY1TUiMTVpx67lMaH3-COIKKIKvAFvZMvbKjH6fJhVKFFBJgVNtD-k4p_k4NQwQtHjy_gldtUNWJD9kRoLCloo32r6h2RAwi1JiwaBqPWsf7v9_ELfVA23vH8Ojn0jFzfNESeffOkJ8LjlH5zawuChHNZSq9eg6o0w_jrrdlLnhMKJRYl4x09da8GLR4_dKnR8pZiUB58GCDydPYEyt5CIlyYwBMF8VCUx4OPg-gFNh9nc0gGPLNLr7pjFXl-o16wDtRRFakMT_yc3fSo1oEZnulBGzFQOIQLP1k4dD2vDg:170acce306af96d970c7af8698a815939ee5ba5f0b1db4d6ce91fc625b86021e:2024-03-26T16:01:41+07:00
What is endpointURL
?
endpointURL
means Request Target.
The Request-Target is depending on who is sending the request:
When merchant hits DOKU endpoints: The Request-Target is the path of the DOKU API that merchant hits. For instance, if merchant wants to hit DOKU VA API:
https://api.doku.com/
bi-snap-va/v1/transfer-va/create-va. Therefore, the Request-Target value is /bi-snap-va/v1/transfer-va/create-vaWhen DOKU hits merchant endpoints (HTTP Notification / Inquiry Request): The Request-Target is the path of merchant
Notification URL
or theInquiry URL
. For instance, if merchant set theNotification URL
:https://yourdomain.com/payments/notifications
. Therefore, the Request-Target value is/payments/notifications
.
Generate Signature :
After all the stringToSign
component has been set, merchant can now generate the signature :
Calculate the result of
(clientSecret , stringToSign)
usingHMAC_512
Ex :
qd2m9ot+cfq48qJ68+8IYdfkNDMA2hhecM2XegsnZ1Z5Fur9zii8BVm6cI7g1gyhL5/+OFZqAO8Kp0XPMdipfg==
Put the value to each API in X-Signature component in Request Header
Last updated