Signature generation rules

Signature mechanism

To ensure transaction security and the security of API invocations, Ayolinx will conduct signature verification for all requests of interfaces. You need to sign all requests for Ayolinx to confirm your identity.

The signature generation rules are divided into three parts. One is the signature generated when obtaining the AccessToken; the second is the signature generated when calling the interface; the third is the signature for the callback to the merchant. There are differences among the three.

Asynchronous callback signature verification

When Ayolinx sends you an asynchronous callback notification, it will sign the callback request according to the above mechanism. After you receive the asynchronous callback notification, you need to verify the signature of the callback request to confirm that the callback request is indeed from Ayolinx.

Signature generation for obtaining AccessToken

1、Explanation of code logic

requestTimestamp is X-TIMESTAMP in the header when making a request. The format is yyyy-MM-ddTHH:mm:ssXXX, for example: 2024-09-18T06:36:36+00:00. If it's in the east seventh zone, it would be 2024-09-18T06:36:36+07:00

$private_key is the private key of the key pair generated by the merchant

2、Demo presentation

PHP

Java

We use the above-mentioned private_key to generate the signature result：
jBOr9d5CRTbzunJyFKktb0+/oJi9H6nO6+o89iI28ZOP80kxh6YFaDryw+KsCALB+ylBp6ZbHAB3XwXa08ZqnVr7Tgv7vplbBii3pG3QXGNN41Qi1s4/fpYGKkpprUenIYPy59482/GoEbXEnutrPUtTKIXf7z4zkcFwngurByo1iHxEKIFxKFKJq5XR70FfTsXZQPDTC9VsKCqJ+PYaCVHtv9fAe2Bo1kaDzWGzESzpbFBpr8k0H6Fngboje9GgtWRFlcdYRM5NLYNuFJ7rXN1f792aX1s9nS8eDmXAJlJeMR/j509mBiIJeF3OkAgD5yuqZvtYJdYLYYoe8SU8jQ==

Signature generation for invoking interfaces

1、Explanation of code logic

$body is all the parameters passed in the request body, and the format is json

$method is the request method
$url is the interface name
$token is the Authorization Token, without the Bearer prefix
$requestTimestamp is X-TIMESTAMP in the header when making a request. The format is yyyy-MM-ddTHH:mm:ssXXX, for example: 2024-09-18T06:36:36+00:00. If it's in the east seventh zone, it would be 2024-09-18T06:36:36+07:00
$data example：POST:/direct-debit/core/v1/debit/payment-host-to-host:7bd8be52a84cc95155756773cf34eade:e6fadcabcf365f76b7ad5e54f8a29015e7392905fa5822ae284fadccf3ef4d12:2025-01-16T17:30:56+07:00

$client_secret is the client_secret parameter generated by the Ayolinx platform after the merchant creates an account

2、Demo presentation

PHP

Java

The signature result obtained using the above data：
jmI+wVObzka8DvwIH1CCUo5AvARo4IZf4S8SSLOhNpKipRtwyQCOM6Kkr6k6wDAVgSZ+MbaxjGLQjqrK0o4ojw==

Ayolinx Callback Merchant Signature Verification Rules

1、Explanation of code logic

$method is the request method.
$url is the interface name.
$requestTimestamp is X-TIMESTAMP in the header when making a request. The format is yyyy-MM-ddTHH:mm:ssXXX. For example: 2024-09-18T06:36:36+00:00. If it's in the east seventh zone, it would be 2024-09-18T06:36:36+07:00.
$data example：POST:/v1.0/qr/qr-mpm-notify:7bd8be52a84cc95155756773cf34eade:2025-01-16T17:30:56+07:00

2、Demo presentation

PHP

Java

Signature generation rules