Go Example

Example: POST /payIn/orders/createAndPay, sign data is timestamp|nonce|rawBody.

package main

import (
    "crypto/hmac"
    "crypto/sha256"
    "encoding/base64"
    "fmt"
    "time"
)

func sign(timestamp, nonce, body, secret string) string {
    signData := timestamp + "|" + nonce + "|" + body
    mac := hmac.New(sha256.New, []byte(secret))
    mac.Write([]byte(signData))
    return base64.StdEncoding.EncodeToString(mac.Sum(nil))
}

func main() {
    body := `{"merchantOrderNo":"M202412220001","amount":"100.00","currency":"USD",` +
        `"methodCode":"INTERNATIONAL_CARD","methodData":{"cardNumber":"4111111111111111",` +
        `"expiryMonth":"12","expiryYear":"27","securityCode":"123"}}`
    timestamp := fmt.Sprintf("%d", time.Now().UnixMilli())
    nonce := "b2b2f3b6a6f24a4ba3dcd0e777c9a888"
    signature := sign(timestamp, nonce, body, "sk_test_9f3b8a2d7c1e4f6a8b0c2d4e6f8a1b3c")

    // Send the request and set headers:
    // X-Merchant-Id, X-Timestamp, X-Nonce, X-Sign
    _ = signature
}

Verify signature (callback)

rawBody is the exact JSON string received in the callback.

package main

import (
    "crypto/hmac"
    "crypto/sha256"
    "encoding/base64"
    "fmt"
)

func sign(timestamp, nonce, body, secret string) string {
    signData := timestamp + "|" + nonce + "|" + body
    mac := hmac.New(sha256.New, []byte(secret))
    mac.Write([]byte(signData))
    return base64.StdEncoding.EncodeToString(mac.Sum(nil))
}

func verify(timestamp, nonce, rawBody, secret, signHeader string) bool {
    expected := sign(timestamp, nonce, rawBody, secret)
    return hmac.Equal([]byte(expected), []byte(signHeader))
}

func main() {
    rawBody := `{"payNo":"P202312230001","tradeStatus":"SUCCESS"}`
    timestamp := "1734921005000"
    nonce := "b2b2f3b6a6f24a4ba3dcd0e777c9a888"
    signHeader := "base64_signature_from_header"

    ok := verify(timestamp, nonce, rawBody, "sk_test_9f3b8a2d7c1e4f6a8b0c2d4e6f8a1b3c", signHeader)
    fmt.Println(ok)
}