Potapay(English)
    • Interface description
    • appoint
    • Signature & Signature Algorithm
    • Test parameter
    • Error code
    • v1
      • Create invoice order
        POST
      • Create a payment order
        POST
      • Order inquiry
        POST
      • Account balance inquiry
        POST
      • Certificate query
        POST
    • v2
      • Mexico
        • List of Mexican banks
        • Test parameters
        • Query
          • Order Inquiry
          • Account Balance Inquiry
          • Voucher Inquiry
        • Create a invioce order
        • Create a payment order
      • Brazil
        • Create invioce order
        • Create payment order - no query restrictions
        • Create payment order
        • Order inquiry
        • Account balance inquiry
        • Certificate query
    • webhook Request
      POST
    • Schemas
      • payin parameters
      • payin parameters v2
      • payout parameters
      • order query
      • balance query
      • webhook
      • proof query
      • payout manual

    Signature & Signature Algorithm

    When signing RSA (PKCS#8 format 4096 bits), the private key is required for signature, and the merchant needs to generate the key pair by itself, and upload the public key to the merchant background, and obtain the platform public key in the merchant background.

    Signature and signature verification#

    Sign the full content of the request using SHA256withRSA(PKCS#8 format 4096 bits), placing the signature value in Headers["X-Signature"]

    pseudo-code:#

    Generate signature#

    Or online generation:
    https://acte.ltd/utils/openssl
    Select 4096 key length and PKCS#8 key format
    On-line check tool:
    https://8gwifi.org/rsasignverifyfunctions.jsp

    Data signature#

    Gets the complete request data string, such as
    {
        "mchOrderNo": "test-payout-000024",
        "notifyUrl": "https://webhook.site/8f874726-a8c3-458b-8525-0abb921f243a",
        "amount": 1000,
        "accountName": "jack",
        "accountNo": "0987654321",
        "accountType": 1,
        "phone": "+551234567890",
        "email": "FrancesStanley@Gabspot.com",
        "remark": "ullam qui laborum iste vitae."
    }
    SHA256withRSA signature of the requested data using RSA

    Request interface#

    Add X-Signature to the header with the value sign(signature).

    example#

    golang example#

    import (
        "crypto"
        "crypto/rand"
        "crypto/rsa"
        "crypto/sha256"
        "crypto/x509"
        "encoding/pem"
        "encoding/base64"
        "errors"
    )
    
    const (
    	PrivateKeyTypeStringPKCS8 = "PRIVATE KEY"
    	PublicKeyTypeStringPKCS8  = "PUBLIC KEY"
    )
    func RSASignaturePKCS8(msg []byte, priKey []byte) ([]byte, error) {
    	block, _ := pem.Decode(priKey)
    	if block == nil || block.Type != PrivateKeyTypeStringPKCS8 {
    		log.Println("failed to decode PEM block containing private key")
    		return nil, errors.New("failed to decode PEM block containing private key")
    	}
    	key, err := x509.ParsePKCS8PrivateKey(block.Bytes)
    	if err != nil {
    		return nil, err
    	}
    	privateKey := key.(*rsa.PrivateKey)
    	hashed := sha256.Sum256(msg)
    	data, err := rsa.SignPKCS1v15(rand.Reader, privateKey, crypto.SHA256, hashed[:])
    	if err != nil {
    		return nil, err
    	}
    	return data, nil
    }
    
    func RSAVerifyPKCS8(msg []byte, signature []byte, pubKey []byte) error {
    	block, _ := pem.Decode(pubKey)
    	if block == nil || block.Type != PublicKeyTypeStringPKCS8 {
    		log.Println("failed to decode PEM block containing public key")
    		return errors.New("failed to decode PEM block containing public key")
    	}
    	key, err := x509.ParsePKIXPublicKey(block.Bytes)
    	if err != nil {
    		return err
    	}
    	publicKey := key.(*rsa.PublicKey)
    	hashed := sha256.Sum256(msg)
    	return rsa.VerifyPKCS1v15(publicKey, crypto.SHA256, hashed[:], signature)
    }
    
    func Base64Encode(src []byte) string {
            return base64.StdEncoding.EncodeToString(src)
    }

    java example#

    Note: java needs to remove the symbol,,
    such as:`-----BEGIN PUBLIC KEY-----
    MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAqiYvFg1qxstxuZOUST62
    GZlnH0HySBg+tsoIZb4faIDgyl9xj5wXdUqvu0p+/fMDPUvWTtYNQ1XehmkL2YMS
    PZJeYCkhgAgi9d9gVqjl88huy9La+WXetj5LU7o8V0ACYBjB2tvFx+LvW18RKsM7
    dfOC8pH0+1pHbS44OvMHVcoDXDCzoGBR1KKFCwfUvvCWRgRqf2c5YfUbURPf3++F
    kcc/uWlJYoO7hXQN/3Br28sCAwEAAQ==
    -----END PUBLIC KEY-----
    在java中publicKey = "MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAqiYvFg1qxstxuZOUST62GZlnH0HySBg+tsoIZb4faIDgyl9xj5wXdUqvu0p+/fMDPUvWTtYNQ1XehmkL2YMSPZJeYCkhgAgi9d9gVqjl88huy9La+WXetj5LU7o8V0ACYBjB2tvFx+LvW18RKsM7dfOC8pH0+1pHbS44OvMHVcoDXDCzoGBR1KKFCwfUvvCWRgRqf2c5YfUbURPf3++Fkcc/uWlJYoO7hXQN/3Br28sCAwEAAQ=="
    privateKey In a similar way

    python example#

    test#

    PHP example#

    Modified at 2026-02-10 13:17:07
    Previous
    appoint
    Next
    Test parameter
    Built with