Common Tools · Signature and Security

API Signature

Generate and verify HMAC signatures.

API Signature

Generate and verify PSP API authentication signatures.

Success

Input

AlgorithmOutput

MethodPattern

URL pathQuery string

TimestampNonce

HeadersHeaders to includeBodySecret keyPasted signature to verify

Keep secrets in sandbox form only. This browser tool does not persist secret values.

Output

Canonical string

POST
/v1/payments?merchantId=MERCHANT123&currency=USD
2026-06-17T12:19:49Z
8f3c2e9a-6b5d-4c5a-9f8e-1a2b3c4d5e6f
content-type:application/json
x-api-key:MERCHANT123
{"amount":"100.00","currency":"USD","merchantId":"MERCHANT123","reference":"ORDER-20250617-001"}

Signature (base64)

9KhekuSl7Ee2dMVclKgwOTxcWi2e5c+ZcLle3Xwh/oo=

Body SHA-256

ab60a83e85fc444c3a9acf9c4a54f152f74b2de9c310c64ffc2e697bbdac758d

Generated curl

curl -X POST "https://api.example.com/v1/payments?merchantId=MERCHANT123&currency=USD" \
  -H "content-type: application/json" \
  -H "host: api.example.com" \
  -H "x-api-key: MERCHANT123" \
  -H "X-Signature: 9KhekuSl7Ee2dMVclKgwOTxcWi2e5c+ZcLle3Xwh/oo=" \
  --data "{\n  \"amount\": \"100.00\",\n  \"currency\": \"USD\",\n  \"merchantId\": \"MERCHANT123\",\n  \"reference\": \"ORDER-20250617-001\"\n}"

Issues

Query parameters were sorted for the selected pattern. Sorting mismatches often break signatures.