Credentials & Signature

Credentials

To start integrating with Toko Netzme API make sure you already have all secret keys

Netzme team will provide you the secrets via email.

Key Name	Value	Description
CLIENT_ID	e.g: TokoNetmeClientId	Identifier, provided to you by Netzme
CLIENT_SECRET	e.g: f013bc2810be469790dc99773c08812e	Secret Identifier, provided to you by Netzme
Private_Key	e.g: MIIBOQIBAAJBAJalQt9eQzzNLvaNRA7WM1nUuFFc06T9TmeIl5Di3VI5IH1Fn//hVqgbCVf9FWPU/hrc0wZzr4dP53o2CnMLqHsCAwEAAQJAcGKB7Rnpl2aLbqwc5eSvEok7qJdT3XaME3k3eYOGEVwf91LUrR9soDJV9QAJA1Vg3vhCbyBwTdjCvnzJNUH1AQIhAMXvclXRO1xPEnSToHEDPv9WT9Q5j5AfYDFeIBC4C/LhAiEAwtZx5kzJUouj1CBhQp0KAOxWs2ecec9PnIUaJR2xItsCIEkdv32F8ciSiP25Ps4gZdgKeSirLqYNgQobe/rREdDhAiBywKiu0lTUiCgCfNurxyAoMQpTedfAKmiiMAaZC6bTdwIgNW0qKB9+h2+v5j3x8BrbQbf80xZRqsBcUyZWr5uGs5U=	Private RSA KEY, provided to you by Netzme
x-callback-token	e.g: Z3kwbFV5bTZnSTNjSmhlNDhDa2d0UjRORk1abW5NSmVZbTJpbldtbFhUczlnWVBXbG9xdU1mS2d4cWxwUkhJVEcycWx5d0lLRmxsNW8yYURKQlc4YVJYNzE3c0lqVXk1a0Rxdg==	Your Netzme unique callback token to verify the origin of the callback. This parameter will be provided on every callback, e.g Payment Success Callback

Signature

1. Signature Authentication

X-SIGNATURE parameter contains Signature for ensure that the data in every request and response cannot be hijacked and imitated by unauthorized users. You will need to provide the parameters on Authentication endpoint.

How to compute the authentication signature

stringToSign = CLIENT_ID + "|" + X-TIMESTAMP
X-SIGNATURE = SHA256WithRSA(Private_Key, stringToSign)

Key	Value
Private_Key	e.g: MIIBOQIBAAJBAJalQt9eQzzNLvaNRA7WM1nUuFFc06T9TmeIl5Di3VI5IH1Fn//hVqgbCVf9FWPU/hrc0wZzr4dP53o2CnMLqHsCAwEAAQJAcGKB7Rnpl2aLbqwc5eSvEok7qJdT3XaME3k3eYOGEVwf91LUrR9soDJV9QAJA1Vg3vhCbyBwTdjCvnzJNUH1AQIhAMXvclXRO1xPEnSToHEDPv9WT9Q5j5AfYDFeIBC4C/LhAiEAwtZx5kzJUouj1CBhQp0KAOxWs2ecec9PnIUaJR2xItsCIEkdv32F8ciSiP25Ps4gZdgKeSirLqYNgQobe/rREdDhAiBywKiu0lTUiCgCfNurxyAoMQpTedfAKmiiMAaZC6bTdwIgNW0qKB9+h2+v5j3x8BrbQbf80xZRqsBcUyZWr5uGs5U=
CLIENT_ID	e.g: TokoNetmeClientId
X-TIMESTAMP	Client's current local time in yyyy-MM-ddTHH:mm:ssTZD

See the sample code

2. Signature Service

X-SIGNATURE parameter contains Signature for ensure that the data in every request and response cannot be hijacked and imitated by unauthorized users. You will need to provide the parameters on every transactional endpoint (e.g: Get Balance Detail, Get Transaction List, etc).

How to compute the transactional signature

stringToSign = HTTPMethod + ":" + EndpointUrl + ":" + AccessToken + ":" + Lowercase(HexEncode(SHA256(minify(RequestBody)))) + ":" + X-TIMESTAMP
X-SIGNATURE = HMAC_SHA512(CLIENT_SECRET, stringToSign)

Key	Value
CLIENT_SECRET	e.g: f013bc2810be469790dc99773c08812e
HTTPMethod	Http Method, e.g: POST, GET, PUT, PATCH
EndpointUrl	Endpoint to hit. e.g: /v1.0/api/transaction-history-list
AccessToken	accessToken value from Authentication
RequestBody	Your RAW request body(must be minified). e.g: transaction list request

See the sample code

Sample Code

1. Authentication Signature

Sample Code (Java)

public void generateSignatureForAuthentication() {

    String clientId = "NetmeClientId";
    String timeStamp = "2022-08-10T00:00:00+07:00";
    String privateKey = "MIIBOQIBAAJBAJalQt9eQzzNLvaNRA7WM1nUuFFc06T9TmeIl5Di3VI5IH1Fn//hVqgbCVf9FWPU/hrc0wZzr4dP53o2CnMLqHsCAwEAAQJAcGKB7Rnpl2aLbqwc5eSvEok7qJdT3XaME3k3eYOGEVwf91LUrR9soDJV9QAJA1Vg3vhCbyBwTdjCvnzJNUH1AQIhAMXvclXRO1xPEnSToHEDPv9WT9Q5j5AfYDFeIBC4C/LhAiEAwtZx5kzJUouj1CBhQp0KAOxWs2ecec9PnIUaJR2xItsCIEkdv32F8ciSiP25Ps4gZdgKeSirLqYNgQobe/rREdDhAiBywKiu0lTUiCgCfNurxyAoMQpTedfAKmiiMAaZC6bTdwIgNW0qKB9+h2+v5j3x8BrbQbf80xZRqsBcUyZWr5uGs5U=";
    String stringToSign = clientId + "|" + timeStamp;

    try {
        byte[] decodeBase64 = org.apache.commons.codec.binary.Base64.decodeBase64(privateKey);
        java.security.PrivateKey key = readPkcs1PrivateKey(decodeBase64);
        java.security.Signature privateSignature = java.security.Signature.getInstance("SHA256withRSA");
        privateSignature.initSign(key);
        privateSignature.update(stringToSign.getBytes(StandardCharsets.UTF_8));
        byte[] s = privateSignature.sign();
        String result = java.util.Base64.getEncoder().encodeToString(s);

        //print out :CzXuT1rNLkteTuwMY5tWyg/4lxRLJChag8swpDOiO0IqtwMm8x5O7G+foD7Ufv509Xm6wJJ1lMvBA/pooiM4zQ==
        System.out.println("X-SIGNATURE " + result);
    } catch (java.security.GeneralSecurityException e) {
        e.printStackTrace();
    }
}

private java.security.PrivateKey readPkcs8PrivateKey(byte[] pkcs8Bytes) throws java.security.GeneralSecurityException {

    java.security.KeyFactory keyFactory = java.security.KeyFactory.getInstance("RSA", "SunRsaSign");
    java.security.spec.PKCS8EncodedKeySpec keySpec = new java.security.spec.PKCS8EncodedKeySpec(pkcs8Bytes);
    try {
        return keyFactory.generatePrivate(keySpec);
    } catch (java.security.spec.InvalidKeySpecException e) {
        throw new java.lang.IllegalArgumentException("Unexpected key format!", e);
    }
}

private java.security.PrivateKey readPkcs1PrivateKey(byte[] pkcs1Bytes) throws java.security.GeneralSecurityException {

    int pkcs1Length = pkcs1Bytes.length;
    int totalLength = pkcs1Length + 22;

    byte[] pkcs8Header = new byte[]{
    0x30, (byte) 0x82, (byte) ((totalLength >> 8) & 0xff), (byte) (totalLength & 0xff), // Sequence + total length
    0x2, 0x1, 0x0, // Integer (0)
    0x30, 0xD, 0x6, 0x9, 0x2A, (byte) 0x86, 0x48, (byte) 0x86, (byte) 0xF7, 0xD, 0x1, 0x1, 0x1, 0x5, 0x0, // Sequence: 1.2.840.113549.1.1.1, NULL
    0x4, (byte) 0x82, (byte) ((pkcs1Length >> 8) & 0xff), (byte) (pkcs1Length & 0xff) // Octet string + length
    };

    byte[] pkcs8bytes = joinByte(pkcs8Header, pkcs1Bytes);

    return readPkcs8PrivateKey(pkcs8bytes);
}

private static byte[] joinByte(byte[] byteArray1, byte[] byteArray2) {
    byte[] bytes = new byte[byteArray1.length + byteArray2.length];
    System.arraycopy(byteArray1, 0, bytes, 0, byteArray1.length);
    System.arraycopy(byteArray2, 0, bytes, byteArray1.length, byteArray2.length);
    return bytes;
}

Sample Code (PHP)

<?php
function generateAuthSig($clientId, $clientSecret, $privateKey, $now) {
    $privateKey = <<<EOD
    -----BEGIN RSA PRIVATE KEY-----
    {$privateKey}
    -----END RSA PRIVATE KEY-----
    EOD;

    $hash = $clientId . '|' . $now;
    $signature = '';

    // Sign the data with the private key using SHA256
    if (openssl_sign($hash, $signature, $privateKey, OPENSSL_ALGO_SHA256)) {
        return base64_encode($signature);
    } else {
        throw new Exception('Unable to sign data.');
    }
}

$clientId = "NetmeClientId";
$clientSecret ="";
$privateKey ="MIIBOQIBAAJBAJalQt9eQzzNLvaNRA7WM1nUuFFc06T9TmeIl5Di3VI5IH1Fn//hVqgbCVf9FWPU/hrc0wZzr4dP53o2CnMLqHsCAwEAAQJAcGKB7Rnpl2aLbqwc5eSvEok7qJdT3XaME3k3eYOGEVwf91LUrR9soDJV9QAJA1Vg3vhCbyBwTdjCvnzJNUH1AQIhAMXvclXRO1xPEnSToHEDPv9WT9Q5j5AfYDFeIBC4C/LhAiEAwtZx5kzJUouj1CBhQp0KAOxWs2ecec9PnIUaJR2xItsCIEkdv32F8ciSiP25Ps4gZdgKeSirLqYNgQobe/rREdDhAiBywKiu0lTUiCgCfNurxyAoMQpTedfAKmiiMAaZC6bTdwIgNW0qKB9+h2+v5j3x8BrbQbf80xZRqsBcUyZWr5uGs5U=";
$now ="2022-08-10T00:00:00+07:00";

// Should return CzXuT1rNLkteTuwMY5tWyg/4lxRLJChag8swpDOiO0IqtwMm8x5O7G+foD7Ufv509Xm6wJJ1lMvBA/pooiM4zQ==
echo generateAuthSig($clientId, $clientSecret, $privateKey, $now);

?>

2. Transactional Signature

Sample code (Java)

public void generateTransactionalSignature() {
    javax.crypto.Mac hmac512;
    String xSignature;
    String httpMethod = "GET";
    String endpointUrl = "/v1.0/transaction-history-list";
    String accessToken = "eyJhbGciOiJIUzUxMiIsInR5cCI6IkpXVCJ9.eyJleHAiOjE2Njc4MTM1MjcsImlhdCI6MTY2NzgxMjYyNywiaXNzIjoicmFoeWFuX3N0ZyJ9.nMvam42YO7k40ZfZDjl1b24SPcS79Ic6qrhFEx7pEYyDQ8b1EsjHsWpR4DMi_zFLmQB8tJG7-YOmlFfBeKhacg";
    String timeStamp = "2022-08-10T00:00:00+07:00";
    String rawJsonBody = "{\"body\":{\"limit\":2,\"seqId\":0,\"userId\":\"WXhj9BiA\"},\"requestId\":\"bitdna202106281235010001\",\"type\":\"aggregator_transaction_history\"}";
    String secret = "86f03ec237644c61842e970010d453f8";

    try {
        java.security.MessageDigest digest = java.security.MessageDigest.getInstance("SHA-256");
        byte[] hash256 = digest.digest(rawJsonBody.getBytes(StandardCharsets.UTF_8));
        String encodedBodyRaw = org.apache.commons.codec.binary.Hex.encodeHexString(hash256).toLowerCase();
        String stringToSign = httpMethod + ":" + endpointUrl + ":" + accessToken + ":" + encodedBodyRaw + ":" + timeStamp;
        final byte[] byteKey = secret.getBytes(StandardCharsets.UTF_8);
        hmac512 = javax.crypto.Mac.getInstance("HmacSHA512");
        javax.crypto.spec.SecretKeySpec keySpec = new javax.crypto.spec.SecretKeySpec(byteKey, "HmacSHA512");
        hmac512.init(keySpec);
        byte[] macData = hmac512.doFinal(stringToSign.getBytes(StandardCharsets.UTF_8));
        xSignature = org.apache.commons.codec.binary.Hex.encodeHexString(macData);
      
        //print out : 0a8577a4a93fe19663ea0b367806ff44ca1695994c3b4719bb95f004e64359248defa0e31888013a89fc7c1fc3ba3906d131af3acc0ae9e3f97cb145747fed1b
        System.out.println("X-SIGNATURE " + xSignature);
    } catch (java.security.InvalidKeyException | java.security.NoSuchAlgorithmException e) {
        // Error generate signature.
        e.printStackTrace();
    }
}

Sample code (PHP)

<?php
function generateServiceSignature($clientSecret, $method,$uri, $token, $body, $now) {
    $data = json_encode($body);
    $signature = '';
    $data = "{$method}:{$uri}:{$token}:". hash('sha256', $data) .":{$now}";

    $signature = hash_hmac('sha512', $data, $clientSecret);

    return $signature;
}

$clientSecret = "86f03ec237644c61842e970010d453f8";
$method = "GET";
$uri = "/v1.0/transaction-history-list";
// Token are response from api https://apidocs-vsnap.netzme.id/api-reference/toko-netzme/authentication
$token = "eyJhbGciOiJIUzUxMiIsInR5cCI6IkpXVCJ9.eyJleHAiOjE2Njc4MTM1MjcsImlhdCI6MTY2NzgxMjYyNywiaXNzIjoicmFoeWFuX3N0ZyJ9.nMvam42YO7k40ZfZDjl1b24SPcS79Ic6qrhFEx7pEYyDQ8b1EsjHsWpR4DMi_zFLmQB8tJG7-YOmlFfBeKhacg";

$data = [
  "body" => [
      "limit" => 2,
      "seqId" => 0,
      "userId" => "WXhj9BiA"
  ],
  "requestId" => "bitdna202106281235010001",
  "type" => "aggregator_transaction_history"
];
$now = "2022-08-10T00:00:00+07:00";

// Should return: 0a8577a4a93fe19663ea0b367806ff44ca1695994c3b4719bb95f004e64359248defa0e31888013a89fc7c1fc3ba3906d131af3acc0ae9e3f97cb145747fed1b%
echo "Service Sig: " . generateServiceSignature($clientSecret, $method, $uri, $token, $data, $now);
?>