Signature
Elite Neo Bank APIs use HMAC SHA256 based request signing to authenticate and validate every API request securely. Each request must include a generated signature in the X-SIGNATURE header. The signature helps verify:- Request authenticity
- Payload integrity
- Timestamp validity
- Merchant authorization
Signature Formula
How Signature Generation Works
To generate a valid signature:- Prepare the request payload
- Recursively sort all payload keys
- Convert the payload into JSON format
- Generate current UNIX timestamp in seconds
- Concatenate:
- Generate HMAC SHA256 hash using your
secret_key
Example Payload
Important Payload Rules
Before generating the signature:- Payload keys must be sorted recursively
- JSON payload must remain unchanged
- Use unescaped slashes in JSON encoding
- Do not modify payload after signature generation
- Generate a fresh timestamp for every request
- Request payload
- Timestamp
- Secret key
- Node.js
- PHP
- Python
- Java
- .NET (C#)
- Flutter / Dart
- Go
Common Authentication Errors
401 Unauthorized
Possible reasons:- Invalid signature
- Wrong secret key
- Expired timestamp
- Incorrect payload format
- Missing headers
Invalid Signature
This usually happens when:- Payload is modified after signing
- Keys are not sorted correctly
- JSON formatting differs
- Timestamp mismatch occurs
Security Best Practices
- Never expose your
secret_keypublicly - Always generate signatures on the server side
- Use HTTPS for all API requests
- Generate unique timestamps for every request
- Rotate credentials periodically
- Validate webhook signatures before processing callbacks
Recommended Workflow
- Generate timestamp
- Prepare payload
- Generate signature
- Attach required headers
- Send API request
- Validate API response
