Signature Rules

Signature Algorithm Description

Encryption Method	SHA256WithRSA
Key Format	PKCS8
Signature Algorithm	SHA256WithRSA, then base64 encoding
Key Length	2048

Key Generation Instructions

The merchant needs to generate a pair of private and public keys, then exchange public keys with Payjn. Please keep your private key safe to prevent leakage.

Payjn does not accept merchant private keys. Do not send your private key to Payjn.

Use Payjn's public key to verify signatures for asynchronous notifications.

Online key generation tool provided by this platform: https://apitest.payjn.com/rsa-key-generator

Signature Steps

Convert the request payload into a JSON string.

Concatenate the JSON string with the API endpoint (using &).

Use the merchant's RSA private key to sign with SHA256WithRSA.

Place the resulting signature in the HTTP header with the key sign.

Note: The JSON string is the HTTP request body. Payjn will verify the signature using the original content.

Example: Creating a Payout Order Signature

API endpoint: ${host}/api-pay/payout/order/create

Assume the parameters sent are as follows:

{
   "merchantCode": "258251",
   "amount": 30000.00,
   "countryCode": "IDN",
   "merchantOrderId": "P20250203850899",
   "bankCode": "DANA",
   "bankAccountNo": "081234567890",
   "merchantNotifyUrl": "http://merchant-api.com/callback",
   "customer": {
      "name": "Clinton Alisa",
      "email": "clintonAlisa@gmail.com",
      "phone": "08126788314"
   }
}

Signature plaintext:

{
  "merchantCode": "258251",
  "amount": 30000.00,
  "countryCode": "IDN",
  "merchantOrderId": "P20250203850899",
  "bankCode": "DANA",
  "bankAccountNo": "081234567890",
  "merchantNotifyUrl": "http://merchant-api.com/callback",
  "customer": {
    "name": "Clinton Alisa",
    "email": "clintonAlisa@gmail.com",
    "phone": "08126788314"
  }
}&/api-pay/payout/order/create

Request with signature:

Demo

Java

Python

Golang

Notes

The signature must use the merchant's private key, and verification must use Payjn's public key.

The signature value must be base64 encoded.

The signature must be placed in the HTTP header with the key sign.

The signature plaintext must be concatenated strictly according to the rules.

Please keep your private key safe and do not disclose it to any third party.

Signature Algorithm Description#

Key Generation Instructions#

Signature Steps#

Example: Creating a Payout Order Signature#

Demo#

Java#

Python#

Golang#

Notes#