> For the complete documentation index, see [llms.txt](https://docs.coda.co/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.coda.co/payout/integration-guides/getting-started/how-to-generate-the-x-signature.md).
# How to generate the x-signature
For every payout request, the Coda system will carry out a verification process to ensure its integrity. Coda will compare the ***x-signature*** header in the request with the signature of the request body.\
\
If the signatures do not match, our system will reject the request and return error (refer[ Error Handling](broken://pages/WuSQ6Di8oxGebgLBG22m) for more details)\
\
This process is to ensure the integrity and security of our payout requests, reducing the risk of any payload being tampered.\
\
Here's how the signature is generated:
1. The request body is condensed to remove any trailing spaces and carriage returns.
2. The payload is then signed using the ***HmacSHA256*** **algorithm** with a shared secret. It's important to note that this secret is different from the one used for JWT signing. Coda will provide this secret separately.
3. The resulting signature is encoded in **base64** format.
### Signature generation sample code:
```javascript
package com.coda.codapay.payout.model.authorizer;
import com.coda.codapay.payout.util.JWebToken;
import com.fasterxml.jackson.core.JsonProcessingException;
import com.fasterxml.jackson.databind.JsonNode;
import com.fasterxml.jackson.databind.ObjectMapper;
import javax.crypto.Mac;
import javax.crypto.spec.SecretKeySpec;
import java.nio.charset.StandardCharsets;
import java.security.InvalidKeyException;
import java.security.NoSuchAlgorithmException;
import java.util.Base64;
import java.util.logging.Level;
import java.util.logging.Logger;
public class SignatureVerifier {
private static String generateSignature(String data, String secret) {
try {
byte[] hash = secret.getBytes(StandardCharsets.UTF_8);
Mac sha256Hmac = Mac.getInstance("HmacSHA256");
SecretKeySpec secretKey = new SecretKeySpec(hash, "HmacSHA256");
sha256Hmac.init(secretKey);
byte[] signedBytes = sha256Hmac.doFinal(data.getBytes(StandardCharsets.UTF_8));
return Base64.getEncoder().encodeToString(signedBytes);
} catch (NoSuchAlgorithmException | InvalidKeyException ex) { Logger.getLogger(JWebToken.class.getName()).log(Level.SEVERE, ex.getMessage(), ex);
return null;
}
}
private static String minifyRequestBody(String requestBody) {
ObjectMapper objectMapper = new ObjectMapper();
JsonNode jsonNode = null;
try {
jsonNode = objectMapper.readValue(requestBody, JsonNode.class);
} catch (JsonProcessingException e) {
throw new RuntimeException(e);
}
return jsonNode.toString();
}
public static void main(String[] args) {
String secret = "Ob12@7n2tGVpK^cmrCa$";
String payload = "{\n" +
" \"payout_method\": {\n" +
" \"type\": \"bank_transfer\",\n" +
" \"payment_method\": \"bank_transfer\",\n" +
" \"beneficiary\": {\n" +
" \"name\": \"Steve\",\n" +
" \"payout_method_details\": {\n" +
" \"account_currency\": \"EGP\",\n" +
" \"account_name\": \"John doe\",\n" +
" \"account_number\": \"1234567890\",\n" +
" \"iban\": \"EG829299835700000000001111111\",\n" +
" \"swift_code\": \"DEIBEGCX016\",\n" +
" \"bank_code\": \"AUB\"\n" +
" }\n" +
" }\n" +
" },\n" +
" \"amount\": {\n" +
" \"value\": \"11.11\",\n" +
" \"currency_code\": \"EGP\"\n" +
" },\n" +
" \"country_code\": \"EG\",\n" +
" \"purpose\": \"salaries\",\n" +
" \"reference\": \"reference john doe\",\n" +
" \"request_id\": \"request_id_12344545\",\n" +
" \"due_date\": \"2022-04-22\"\n" +
"}";
String minifiedRequestBody = minifyRequestBody(payload);
// minified request body
System.out.println(minifiedRequestBody);
String signature = generateSignature(minifiedRequestBody, secret); // generate and sign signature
System.out.println(signature); // signature value for checksum pOsnb4LGor0_iOPsc_7ufSiQHslKkV6_iJ6c6tEpP3k
}
}
```
### Sample payload:
```javascript
{
"payout_method": {
"type": "bank_transfer",
"payment_method": "bank_transfer",
"beneficiary": {
"name": "Steve",
"payout_method_details": {
"account_currency": "EGP",
"account_name": "John doe",
"account_number": "1234567890",
"iban": "EG829299835700000000001111111",
"swift_code": "DEIBEGCX016",
"bank_code": "AUB"
}
}
},
"amount": {
"value": "11.11",
"currency_code": "EGP"
},
"country_code": "EG",
"purpose": "salaries",
"reference": "reference john doe",
"request_id": "request_id_12344545",
}
```
### x-signature shared secret sample:
Remark: Please note that this secret key will be share by Coda
```
Ob12@7n2tGVpK^cmrCa$
```
### Expected generated x-signature value:
```
pOsnb4LGor0/iOPsc/7ufSiQHslKkV6/iJ6c6tEpP3k=
```
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://docs.coda.co/payout/integration-guides/getting-started/how-to-generate-the-x-signature.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.