Authentication & Signature

X-QF-SIGN: <your_signature>

​

How signature generation works

1. Collect request parameters
2. Sort parameters by name
3. Append your client_key
4. Hash the final string
5. Send the signature in the request header

​

Step 1: Sort parameters

mchid=ZaMVg12345&txamt=100&txcurrcd=HKD

​

Step 2: Append your client key

client_key = abcd1234

mchid=ZaMVg12345&txamt=100&txcurrcd=HKDabcd1234

​

Step 3: Hash the string

SHA256("mchid=ZaMVg12345&txamt=100&txcurrcd=HKDabcd1234")

​

Step 4: Add signature to header

X-QF-SIGN: <generated_signature>

​

Important Rules

• Sort parameters alphabetically by name.
• Do not include empty or null parameters.
• Do not include the signature itself in the signing string.
• Parameter names and values are case-sensitive.
• Use UTF-8 encoding when building the string.
• Do not include spaces, line breaks, or extra characters.

​

Example (Node.js)

const crypto = require("crypto");

const payload = {
  txamt: "10",
  txcurrcd: "HKD"
};

const key = "client_key_here";

const ordered = Object.keys(payload)
  .sort()
  .map(k => `${k}=${payload[k]}`)
  .join("&");

const signature = crypto
  .createHash("md5")
  .update(ordered + key)
  .digest("hex")
  .toUpperCase();

console.log(signature);