> For the complete documentation index, see [llms.txt](https://docs.coda.co/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.coda.co/codapay/archived-tokenization-api-2.0/security-and-authentication.md).

# Security and Authentication

## <mark style="color:purple;">Headers</mark>

<table><thead><tr><th width="278">Headers</th><th>Description</th></tr></thead><tbody><tr><td>X-Partner-Id</td><td>This is provided to the partner in essence of being the ‘username’ when partner is registered to this service, this is partner ID is usually stored as reference and not secured.</td></tr><tr><td>X-Api-Key</td><td>This is a secured key generated for each partner to allow authorization to implement requests.</td></tr><tr><td>Authorization</td><td>A generated JWT token that is unique to each request to securely validate an appropriate request. Sample as “Bearer {{jwt}}”. Using the "Bearer" type for JWTs in the Authorization header is a convention, and it helps to distinguish the type of token being used for authentication in an HTTP request. </td></tr><tr><td>Content-Type: Only for POST implementation</td><td>The value is ‘application/json’.</td></tr></tbody></table>

## <mark style="color:purple;">Building JWT Token</mark>

```java
var header = {
	'typ': 'JWT',
	'alg': 'HS256'
};

var currentTimestamp = Math.floor(Date.now() / 1000)

var data = {
	'partner_id': pm.environment.get('partner.id'),
	'iat': currentTimestamp
}


function base64url(source) {
    // Encode in classical base64
    encodedSource = CryptoJS.enc.Base64.stringify(source)
    
    // Remove padding equal characters
    encodedSource = encodedSource.replace(/=+$/, '')
    
    // Replace characters according to base64url specifications
    encodedSource = encodedSource.replace(/\+/g, '-')
    encodedSource = encodedSource.replace(/\//g, '_')
    
    return encodedSource
}

// encode header
var stringifiedHeader = CryptoJS.enc.Utf8.parse(JSON.stringify(header))
var encodedHeader = base64url(stringifiedHeader)

// encode data
var stringifiedData = CryptoJS.enc.Utf8.parse(JSON.stringify(data))
var encodedData = base64url(stringifiedData)

// build token
var token = `${encodedHeader}.${encodedData}`

// sign token
var signature = CryptoJS.HmacSHA256(token, jwtSecret)
signature = base64url(signature)
var signedToken = `${token}.${signature}`

```

### <mark style="color:purple;">Header</mark>

* The header object contains two properties: typ with the value 'JWT' (indicating it's a JWT) and alg with the value 'HS256' (indicating HMAC SHA-256 algorithm for signing).
* The header is then converted to a JSON string.
* The resulting JSON string is UTF-8 encoded.
* The UTF-8 encoded header is then base64 URL encoded to produce the first part of the token.

### <mark style="color:purple;">Payload (Data)</mark>

* The data object contains two properties: partner\_id , and the current timestamp (seconds since epoch) obtained using Math.floor(Date.now() / 1000).
* The data object is converted to a JSON string.
* The resulting JSON string is UTF-8 encoded.
* The UTF-8 encoded data (payload) is then base64 URL encoded to produce the second part of the token.

### <mark style="color:purple;">Building the Token</mark>

* The token is formed by concatenating the encoded header and the encoded data (payload) with a dot separator.

### <mark style="color:purple;">Signing the Token</mark>

* The token is used as the message input for the HMAC SHA-256 algorithm, along with a secret key (jwtSecret).
* The HMAC SHA-256 algorithm produces a signature for the token.
* The signature is binary data.
* The binary signature is then base64 URL encoded to produce the third part of the token.

### <mark style="color:purple;">Constructing the Final JWT</mark>

* The final JWT is formed by concatenating the original token, the dot separator, and the encoded signature.

The resulting JWT variable is a compact JWT that can be used for secure data exchange and authentication. The signature ensures the token's integrity and authenticity, and the recipient can verify the token using the jwtSecret key to ensure that its contents have not been tampered with during transmission.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.coda.co/codapay/archived-tokenization-api-2.0/security-and-authentication.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.