签名生成

const crypto = require('crypto');
const fs = require('fs');

const httpMethod = 'POST';
const endpointUrl = '/api/create/qris'; // 仅路径，不含查询字符串
const timestamp = new Date().toISOString(); // e.g. 2024-12-16T05:11:14.123Z

// 只序列化一次。将这个字符串原样作为请求正文发送。
// GET 请求使用： const body = '';
const body = JSON.stringify({
  merchant_transaction_id: 'ORDER-001',
  amount: '50000',
  currency: 'IDR',
  customer_name: 'John Doe',
  product_name: 'Test Order',
});

const payloadHash = crypto.createHash('sha256').update(body, 'utf8').digest('hex');
const stringToSign = `${httpMethod}:${endpointUrl}:${payloadHash}:${timestamp}`;

console.log('String to Sign:', stringToSign);

// RSA-SHA256，PKCS#1 v1.5 填充（Node.js 对 RSA 密钥的默认值）
const privateKey = fs.readFileSync('./path-to-private-key-file.pem');
const signature = crypto.sign('sha256', Buffer.from(stringToSign, 'utf8'), {
  key: privateKey,
  padding: crypto.constants.RSA_PKCS1_PADDING,
}).toString('base64');

console.log('Generated Signature:', signature);
// 原样发送 `body`，并附带请求头 X-TIMESTAMP: timestamp, X-SIGNATURE: signature

<?php
$httpMethod = 'POST';
$endpointUrl = '/api/create/qris'; // 仅路径，不含查询字符串
$timestamp = date('c'); // e.g. 2026-01-15T14:30:00+07:00

// 只序列化一次。将这个字符串原样作为请求正文发送。
// GET 请求使用： $body = '';
$body = json_encode([
    'merchant_transaction_id' => 'ORDER-001',
    'amount' => '50000',
    'currency' => 'IDR',
    'customer_name' => 'John Doe',
    'product_name' => 'Test Order',
]);

$payloadHash = hash('sha256', $body); // 小写十六进制
$stringToSign = "{$httpMethod}:{$endpointUrl}:{$payloadHash}:{$timestamp}";

echo "String to Sign: {$stringToSign}\n";

// RSA-SHA256，PKCS#1 v1.5 填充
$privateKey = openssl_pkey_get_private('file://./path-to-private-key-file.pem');
openssl_sign($stringToSign, $signature, $privateKey, OPENSSL_ALGO_SHA256);
$signatureB64 = base64_encode($signature);

echo "Generated Signature: {$signatureB64}\n";
// 原样发送 $body，并附带请求头 X-TIMESTAMP: $timestamp, X-SIGNATURE: $signatureB64

import hashlib
import base64
import json
from datetime import datetime, timezone
from cryptography.hazmat.primitives import hashes, serialization
from cryptography.hazmat.primitives.asymmetric import padding

http_method = 'POST'
endpoint_url = '/api/create/qris'  # 仅路径，不含查询字符串
timestamp = datetime.now(timezone.utc).isoformat()  # e.g. 2024-12-16T05:11:14.123456+00:00

# 只序列化一次。将这些字节原样作为请求正文发送。
# GET 请求使用： body = b''
body = json.dumps({
    'merchant_transaction_id': 'ORDER-001',
    'amount': '50000',
    'currency': 'IDR',
    'customer_name': 'John Doe',
    'product_name': 'Test Order',
}, separators=(',', ':')).encode('utf-8')

payload_hash = hashlib.sha256(body).hexdigest()
string_to_sign = f"{http_method}:{endpoint_url}:{payload_hash}:{timestamp}"

print(f"String to Sign: {string_to_sign}")

# RSA-SHA256，PKCS#1 v1.5 填充
with open('./path-to-private-key-file.pem', 'rb') as key_file:
    private_key = serialization.load_pem_private_key(key_file.read(), password=None)

signature = private_key.sign(
    string_to_sign.encode('utf-8'),
    padding.PKCS1v15(),
    hashes.SHA256()
)
signature_b64 = base64.b64encode(signature).decode()

print(f"Generated Signature: {signature_b64}")
# 原样发送 `body`（例如 requests.post(url, data=body, ...)），并附带 X-TIMESTAMP 和 X-SIGNATURE