Signature

Each API request and response sent by Paykassma platform or client's system must contain a signature generated with private keys. The signature helps authorize that the request is sent by a legitimate party, and wasn't modified or sent by a third-party service.

Any request or response without signature or with incorrect signature must be ignored.

The signature is added as "signature" string within "general" object of request/response JSON. Signature in API requests and responses are generated using api_key while signature in postbacks sent by Paykassma are generated using postback_key - both of them are provided during onboarding, and must be kept in secret.

Signature generation

Signature generation in Python

def _flatten(data: typing.Any, prefix: str = "") -> list[str]:
    items = []

    if isinstance(data, dict):
        for key, value in data.items():
            new_prefix = f"{prefix}:{key}" if prefix else key
            items.extend(_flatten(value, new_prefix))
    elif isinstance(data, list):
        for index, value in enumerate(data):
            new_prefix = f"{prefix}:{index}"
            items.extend(_flatten(value, new_prefix))
    else:
        items.append(f"{prefix}:{data}")

    return items


def generate_signature(data: dict[str, typing.Any], api_key: str) -> str:
    if 'general' in data and 'signature' in data['general']:
        data['general'].pop('signature')

    message_bytes = ';'.join(sorted(_flatten(data))).encode('utf-8')  # b'complex:k1:v1;some:value'
    secret_bytes = api_key.encode('utf-8')  # b'some_api_key'
    hmac_digest = hmac.new(secret_bytes, message_bytes, hashlib.sha512).digest()  
    return base64.b64encode(hmac_digest).decode("utf-8")