Authentication
Warning
- Call https:// only. A request sent to
http://is redirected, not run — and it has crossed the network in the clear. Fix the URL; do not rely on the redirect. - Your secret key never goes in a request. Keep it on your server, never in an app or a browser.
| Field | Where | Value |
|---|---|---|
merchant_id | body | M2608001 |
X-Karauti-Timestamp | header | Unix seconds, now. Within ±5 minutes of our clock. |
X-Karauti-Nonce | header | Random, up to 128 characters, new for every request. |
X-Karauti-Signature | header | HMAC-SHA256 of the six lines below, keyed with your secret key, lowercase hex. |
What you sign
Six lines joined with \n, no trailing newline:
merchant_id
timestamp
nonce
POST
/api/v1/transaction # the exact path you call
sha256(raw body), lowercase hex
Code
$body = json_encode($payload);
$ts = time();
$nonce = bin2hex(random_bytes(16));
$path = '/api/v1/transaction';
$signature = hash_hmac('sha256', implode("\n", [
$merchantId, $ts, $nonce, 'POST', $path, hash('sha256', $body),
]), $secretKey);
// send $body exactly as hashed, with the three headers
const crypto = require('crypto');
const body = JSON.stringify(payload);
const ts = Math.floor(Date.now() / 1000).toString();
const nonce = crypto.randomBytes(16).toString('hex');
const path = '/api/v1/transaction';
const signature = crypto.createHmac('sha256', secretKey).update([
merchantId, ts, nonce, 'POST', path,
crypto.createHash('sha256').update(body).digest('hex'),
].join('\n')).digest('hex');
import hashlib, hmac, json, secrets, time
body = json.dumps(payload, separators=(",", ":"))
ts = str(int(time.time()))
nonce = secrets.token_hex(16)
path = "/api/v1/transaction"
signature = hmac.new(secret_key.encode(), "\n".join([
merchant_id, ts, nonce, "POST", path,
hashlib.sha256(body.encode()).hexdigest(),
]).encode(), hashlib.sha256).hexdigest()
Check your code
These inputs must give exactly this signature. If yours differs, the bug is on your side.
| secret key | sk_test_example |
| merchant_id | M2608001 |
| timestamp | 1786686400 |
| nonce | 9f2b41c7d0e8a35b |
| path | /api/v1/transaction |
| body | {"merchant_id":"M2608001","order_id":"ORD-1001","sku":"UNIFF25","user_id":"9003278192"} |
| sha256(body) | 45a5a5f25fd0b193d9cd440b6d14a406ec79cc0ef23cea18e7ba1c896d023e61 |
| signature | a0354e3161525dd5435ad37758e2f88086edfa7b3be049227aa1145bdb0c1e0a |
Warning
Send the same body string you hashed. Letting your HTTP client re-encode the payload changes the bytes and the signature will not match.