How to sign crypto payment API requests (HMAC-SHA256)

X-Api-Key:   <your api key>
X-Timestamp: <current unix time in milliseconds>
X-Signature: hex( HMAC-SHA256( apiSecret,
               timestamp + "\n" + METHOD + "\n" + requestTarget + "\n" + body ) )

const crypto = require('crypto');

function sign(apiSecret, method, requestTarget, body) {
  const timestamp = Date.now().toString();                      // unix milliseconds
  const payload = JSON.stringify(body ?? {});                   // compact; send exactly this string
  const message = timestamp + '\n' + method.toUpperCase() + '\n' + requestTarget + '\n' + payload;
  const signature = crypto.createHmac('sha256', apiSecret).update(message).digest('hex');
  return { timestamp, signature, payload };
}

async function call(method, requestTarget, body) {
  const { timestamp, signature, payload } = sign(process.env.PAYARIES_API_SECRET, method, requestTarget, body);
  const res = await fetch('https://bqpay-api-gateway.buildquick.tech' + requestTarget, {
    method,
    headers: {
      'Content-Type': 'application/json',
      'X-Api-Key': process.env.PAYARIES_API_KEY,
      'X-Timestamp': timestamp,
      'X-Signature': signature,
    },
    body: method === 'GET' ? undefined : payload,
  });
  return { status: res.status, body: await res.json() };
}

import hashlib, hmac, json, os, time
import requests

def call(method, request_target, body=None):
    timestamp = str(int(time.time() * 1000))                    # unix milliseconds
    # Compact separators and ensure_ascii=False give the same bytes JSON.stringify would.
    payload = json.dumps(body if body is not None else {}, separators=(",", ":"), ensure_ascii=False)
    message = f"{timestamp}\n{method.upper()}\n{request_target}\n{payload}"
    signature = hmac.new(os.environ["PAYARIES_API_SECRET"].encode(), message.encode(), hashlib.sha256).hexdigest()
    return requests.request(
        method,
        "https://bqpay-api-gateway.buildquick.tech" + request_target,
        headers={
            "Content-Type": "application/json",
            "X-Api-Key": os.environ["PAYARIES_API_KEY"],
            "X-Timestamp": timestamp,
            "X-Signature": signature,
        },
        data=None if method == "GET" else payload.encode(),     # send the exact bytes you signed
        timeout=30,
    )

package payaries

import (
	"crypto/hmac"
	"crypto/sha256"
	"encoding/hex"
	"strconv"
	"time"
)

// Sign returns the X-Timestamp and X-Signature header values. body must be the exact JSON string you
// will send ("{}" for a request with no body). Marshal the request once and reuse those bytes.
func Sign(apiSecret, method, requestTarget, body string) (timestamp, signature string) {
	timestamp = strconv.FormatInt(time.Now().UnixMilli(), 10)
	mac := hmac.New(sha256.New, []byte(apiSecret))
	mac.Write([]byte(timestamp + "\n" + method + "\n" + requestTarget + "\n" + body))
	return timestamp, hex.EncodeToString(mac.Sum(nil))
}

API_KEY="$PAYARIES_API_KEY"; API_SECRET="$PAYARIES_API_SECRET"
BASE=https://bqpay-api-gateway.buildquick.tech
TS=$(($(date +%s) * 1000))                       # unix milliseconds
TARGET='/v1/invoices?status=settled&limit=10'    # path + query, exactly as sent
BODY='{}'                                        # a GET signs the empty object
SIG=$(printf '%s\n%s\n%s\n%s' "$TS" GET "$TARGET" "$BODY" | openssl dgst -sha256 -hmac "$API_SECRET" -hex | sed 's/^.* //')

curl -s "$BASE$TARGET" \
  -H "X-Api-Key: $API_KEY" -H "X-Timestamp: $TS" -H "X-Signature: $SIG"