Required Headers
All API requests must include the following headers, following the Asymmetric Without Get Token security standard established by Bank Indonesia:
| Header | Description |
|---|---|
| X-PARTNER-ID | Your client key provided during onboarding |
| X-TIMESTAMP | Current timestamp in ISO8601 format (e.g., 2024-12-19T17:07:05+07:00) |
| X-SIGNATURE | RSA-SHA256 signature generated from the request (see Signature Generation) |
Additionally, include Content-Type: application/json and Accept: application/json for all requests with a body.
No separate token request is needed — the signature is sent directly via X-SIGNATURE with each request.