Signature Generation

The HMAC signature is generated using the following process:

1. Canonical JSON Serialization

The request body is canonicalized to ensure consistent signatures regardless of JSON key ordering:

• Object keys are sorted alphabetically

• No whitespace between elements

• Consistent string escaping

• Handles nested objects and arrays recursively

Example:

// Original JSON (key order may vary)
{"name": "John", "age": 30, "city": "New York"}

// Canonical JSON (always same output)
{"age":30,"city":"New York","name":"John"}

2. HMAC-SHA256 Calculation

signature = HMAC-SHA256(canonical_body, client_secret)

Where:

• canonical_body is the canonicalized JSON string. For GET or requests with no body, use the string "{}" (canonical empty object), not the literal empty string "". The API and SDK sign GET requests with "{}".

• client_secret is your API client secret

• Output is hexadecimal string