Prodege MR API Request Signing

Each request to the Prodege MR API must be signed. The signature is based on the following formula, where StringToSign consists of all request parameters sorted alphabetically by key and concatenated using a colon (:).

Signature Generation Formula:

Base64( SHA256( UTF-8-Encoding-Of( SecretKey + ":" + StringToSign) ) )

Example Request

For a request to /project-create with parameters:

• apik=yBnXUjjiXSXZ
• country_id=1
• loi=10
• project_id=2025
• project_name=Test Survey
• project_type_id=1
• project_url=https://google.com/%transid%/
• request_date=1442254164458

The StringToSign would be:

apik=yBnXUjjiXSXZ:country_id=1:loi=10:project_id=2025:project_name=Test Survey:project_type_id=1:project_url=https://google.com/%transid%/:request_date=1442254164458

Signature Generation in Code

Java

static String getProdegeMRSignature(String stringToSign, String secretKey)
{
    byte[] utf8Bytes = (secretKey + ":" + stringToSign).getBytes("UTF-8");
    MessageDigest digest = MessageDigest.getInstance("SHA-256");
    byte[] hash = digest.digest(utf8Bytes);
    byte[] base64Hash = Base64.encodeBase64(hash);
    String signature = new String(base64Hash).replace("+", "-")
                                             .replace("/", "_")
                                             .replace("=", "");
    return signature;
}

C#

static string GetProdegeMRSignature(string stringToSign, string secretKey)
{
    var bytes = Encoding.UTF8.GetBytes(secretKey + ":" + stringToSign);
    var algo = new SHA256Managed();
    var hashBytes = algo.ComputeHash(bytes);
    var base64String = System.Convert.ToBase64String(hashBytes);
    var result = base64String.Replace("+", "-")
                             .Replace("/", "_")
                             .Replace("=", "");
    return result;
}

PHP

function getProdegeMRSignature($stringToSign, $secretKey)
{
    $utf8_encoded   = utf8_encode($secretKey . ":" . $stringToSign);
    $sha256_hash    = hash('sha256', $utf8_encoded, true);
    $base64_encoded = base64_encode($sha256_hash);
    $signature      = str_replace("+", "-",
                          str_replace("/", "_",
                          str_replace("=", "", $base64_encoded)));
    return $signature;
}

Python

from hashlib import sha256
from base64 import b64encode

def get_prodegemr_signature(string_to_sign: str, secret_key: str) -> str:
    utf8_encoded = f"{secret_key}:{string_to_sign}".encode("UTF-8")
    hashed = sha256(utf8_encoded).digest()
    base64_encoded = b64encode(hashed).decode("UTF-8")
    return base64_encoded.replace("+", "-").replace("/", "_").replace("=", "")

Notes

Since the SHA256 output is Base64-encoded and may contain URL-unsafe characters, the following replacements must be applied before sending:

Character Replacement Table

For more information, refer to the related documentation on Previous Request Expiration and Next Link Signing.

Last updated 8 months ago.