> For the complete documentation index, see [llms.txt](https://docs.orda.network/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.orda.network/api-reference/api-reference/authentication/signature-generation.md).

# Signature Generation

The HMAC signature is generated using the following process:

#### 1. Canonical JSON Serialization

The request body is canonicalized to ensure consistent signatures regardless of JSON key ordering:

* Object keys are sorted alphabetically
* No whitespace between elements
* Consistent string escaping
* Handles nested objects and arrays recursively

**Example:**

```json
// Original JSON (key order may vary)
{"name": "John", "age": 30, "city": "New York"}

// Canonical JSON (always same output)
{"age":30,"city":"New York","name":"John"}
```

#### 2. HMAC-SHA256 Calculation

```
signature = HMAC-SHA256(canonical_body, client_secret)
```

Where:

* `canonical_body` is the canonicalized JSON string. **For GET or requests with no body**, use the string `"{}"` (canonical empty object), not the literal empty string `""`. The API and SDK sign GET requests with `"{}"`.
* `client_secret` is your API client secret
* Output is hexadecimal string