# Prodege MR API Request Signing

Each request to the Prodege MR API must be signed. The signature is based on the following formula, where _StringToSign_ consists of all request parameters sorted alphabetically by key and concatenated using a colon (`:`).

**Signature Generation Formula**:

```
Base64( SHA256( UTF-8-Encoding-Of( SecretKey + ":" + StringToSign) ) )
```

## Example Request

For a request to `/project-create` with parameters:
- `apik=yBnXUjjiXSXZ`
- `country_id=1`
- `loi=10`
- `project_id=2025`
- `project_name=Test Survey`
- `project_type_id=1`
- `project_url=https://google.com/%transid%/`
- `request_date=1442254164458`

The _StringToSign_ would be:

```
apik=yBnXUjjiXSXZ:country_id=1:loi=10:project_id=2025:project_name=Test Survey:project_type_id=1:project_url=https://google.com/%transid%/:request_date=1442254164458
```

## Signature Generation in Code

### Java
```java
static String getProdegeMRSignature(String stringToSign, String secretKey)
{
    byte[] utf8Bytes = (secretKey + ":" + stringToSign).getBytes("UTF-8");
    MessageDigest digest = MessageDigest.getInstance("SHA-256");
    byte[] hash = digest.digest(utf8Bytes);
    byte[] base64Hash = Base64.encodeBase64(hash);
    String signature = new String(base64Hash).replace("+", "-")
                                             .replace("/", "_")
                                             .replace("=", "");
    return signature;
}
```

### C#
```csharp
static string GetProdegeMRSignature(string stringToSign, string secretKey)
{
    var bytes = Encoding.UTF8.GetBytes(secretKey + ":" + stringToSign);
    var algo = new SHA256Managed();
    var hashBytes = algo.ComputeHash(bytes);
    var base64String = System.Convert.ToBase64String(hashBytes);
    var result = base64String.Replace("+", "-")
                             .Replace("/", "_")
                             .Replace("=", "");
    return result;
}
```

### PHP
```php
function getProdegeMRSignature($stringToSign, $secretKey)
{
    $utf8_encoded   = utf8_encode($secretKey . ":" . $stringToSign);
    $sha256_hash    = hash('sha256', $utf8_encoded, true);
    $base64_encoded = base64_encode($sha256_hash);
    $signature      = str_replace("+", "-",
                          str_replace("/", "_",
                          str_replace("=", "", $base64_encoded)));
    return $signature;
}
```

### Python
```python
from hashlib import sha256
from base64 import b64encode

def get_prodegemr_signature(string_to_sign: str, secret_key: str) -> str:
    utf8_encoded = f"{secret_key}:{string_to_sign}".encode("UTF-8")
    hashed = sha256(utf8_encoded).digest()
    base64_encoded = b64encode(hashed).decode("UTF-8")
    return base64_encoded.replace("+", "-").replace("/", "_").replace("=", "")
```

## Notes
Since the SHA256 output is Base64-encoded and may contain URL-unsafe characters, the following replacements must be applied before sending:

**Character Replacement Table**
| Character | Replacement |  
|-----------|-------------|  
| +         | -           |  
| /         | _           |  
| =         | EMPTY STRING|

---

For more information, refer to the related documentation on [Previous Request Expiration](https://developer.prodege.com/demand/authentication/request-expiration) and [Next Link Signing](https://developer.prodege.com/demand/authentication/link-signing).

Last updated 8 months ago.