> ## Documentation Index
> Fetch the complete documentation index at: https://docs.eliteneobank.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Headers

> Configure the required authentication headers for secure communication with Elite Neo Bank APIs, including client identification, timestamp validation, and HMAC SHA256 signature verification for every requ

# Headers

All Elite Neo Bank API requests must include the required authentication headers to securely communicate with the Elite Neo Bank infrastructure.

These headers are used to:

* Identify your merchant account
* Validate request authenticity
* Verify payload integrity
* Prevent replay attacks
* Secure API communication

Every request sent to Elite Neo Bank APIs must include a valid:

* API Key
* Timestamp
* HMAC SHA256 Signature

Missing or invalid headers may result in authentication failure.

***

## Required Headers

```http theme={null}
Content-Type: application/json
Accept: application/json
X-API-KEY: pk_test_xxxxxxxxx
X-SIGNATURE: GENERATED_SIGNATURE
X-TIMESTAMP: GENERATED_TIMESTAMP
```

## Header Reference

| Header | Required | Description |
| - | - | - |
| `Content-Type` | Yes | Must always be `application/json` |
| `Accept` | Yes | Defines expected API response format |
| `X-API-KEY` | Yes | Your unique Elite Neo Bank API key |
| `X-SIGNATURE` | Yes | HMAC SHA256 generated request signature |
| `X-TIMESTAMP` | Yes | Current UNIX timestamp in seconds |

***

## X-API-KEY

The `X-API-KEY` uniquely identifies your merchant account within the Elite Neo Bank platform.

This key is provided during merchant onboarding and is required for all API requests.

### Example

```
X-API-KEY: pk_test_xxxxxxxxx
```

### Important Notes

* Sandbox and production API keys are different
* Invalid API keys may result in:

```
401 Unauthorized
```

* Never expose production API keys publicly

***

## X-TIMESTAMP

The `X-TIMESTAMP` header contains the current UNIX timestamp in seconds.

Elite Neo Bank validates timestamps to:

* Prevent replay attacks
* Verify request freshness
* Improve API security

### Example

```
X-TIMESTAMP: 1778659835
```

### Important Notes

* Timestamp must be generated dynamically
* Use UNIX seconds format only
* Expired timestamps may be rejected
* Server time should remain synchronized

***

## X-SIGNATURE

The `X-SIGNATURE` header contains the HMAC SHA256 generated request signature.

This signature verifies:

* Merchant authenticity
* Request integrity
* Payload validity

The signature is generated using:\
➡️ Authentication → [Signature](https://docs.eliteneobank.com/guide/authentication/signature.md)

### Example

```
X-SIGNATURE: 623a603fa35bb5ab736a1272dcd797908ab9af4b0247a55bcfc8676cd821a39b
```

### Important Notes

* Signatures must always be generated server-side
* Never expose your secret key publicly
* Payload modifications after signing will invalidate the request
* Invalid signatures may result in:

```
401 Unauthorized
```

***

## Content-Type

Elite Neo Bank APIs accept JSON request payloads only.

### Required Value

```
Content-Type: application/json
```

Requests using unsupported content types may fail validation.

***

## Accept Header

The `Accept` header specifies the expected API response format.

### Required Value

```
Accept: application/json
```

***

## Example Request

```
curl --request POST \--url https://sandbox.Elite Neo Bank.com/api/v3/pg/order/create \--header "Content-Type: application/json" \--header "Accept: application/json" \--header "X-API-KEY: pk_test_xxxxxxxxx" \--header "X-SIGNATURE: GENERATED_SIGNATURE" \--header "X-TIMESTAMP: GENERATED_TIMESTAMP" \--data '{  "order_id": 6116229263036,  "order_amount": 105,  "order_currency": "INR",  "order_note": "Additional order info",  "service_type": "DIGITAL",  "customer": {    "name": "Ajay",    "email": "developer@jangras.co",    "phone": "9816512345"  }}'
```

***

## Common Authentication Errors

### 401 Unauthorized

Possible reasons:

* Invalid API key
* Incorrect signature
* Expired timestamp
* Missing authentication headers

***

### 400 Bad Request

Possible reasons:

* Invalid JSON payload
* Missing required fields
* Incorrect request structure

***

## Security Recommendations

* Always generate signatures server-side
* Never expose secret keys publicly
* Use HTTPS only
* Generate fresh timestamps for every request
* Validate webhook signatures before processing callbacks


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.