Signature generator

Sign requests with HMAC-SHA256. Try it live below, or copy a ready-made snippet in your language.

How it works

Five steps — the live tool and every snippet follow this exactly.

1Collect all request parameters (excluding signature).
2Sort the parameter keys alphabetically (A–Z).
3Form-url-encode into a key1=value1&key2=value2 string (space → +).
4Compute HMAC-SHA256 of that string with your merchant secret key.
5Send the lowercase-hex result as the signature field.

Deposit & withdrawal. Only non-empty fields are signed. A nested source_bank_account (withdrawal) is re-keyed to source_account_bank_code, source_account_no, source_account_name (note _no, not _number). The tool below applies this for you.

Live generator

Paste your params and secret key to compute a signature instantly.

Request payload (JSON)

Works for deposit and withdrawal — empty fields are excluded, and a nested source_bank_account is re-keyed to source_account_* (account_number → source_account_no).

Merchant secret key

Computed live in your browser with the Web Crypto API — the secret never leaves this page.

Signed fields (after re-keying)

—

Canonical string (sorted, form-url-encoded)

—

Signature (HMAC-SHA256, hex)

—

Code examples

Full API reference

# The sorted, form-url-encoded string of the fields you're signing:
STRING='amount=1000&backend_return_url=https%3A%2F%2Fexample.com%2Fwebhook&currency=THB&frontend_return_url=https%3A%2F%2Fexample.com%2Freturn&merchant_id=d0bf1184-c1c9-4101-b034-97e3b44edf4e&payment_method=bank_transfer&reference=ORD1234567&source_account_bank_code=kbank&source_account_name=TEST+HELLO&source_account_no=1234567&timestamp=2025-07-29T21%3A23%3A29%2B07%3A00'

# HMAC-SHA256 with your merchant secret key -> lowercase hex
SIGNATURE=$(printf '%s' "$STRING" | openssl dgst -sha256 -hmac "$MERCHANT_SECRET_KEY" | sed 's/^.* //')
echo "$SIGNATURE"