LEGIONPAYLEGIONPAY
Demo
StableAPI Reference

Introduction

Getting Started with Legionpay

Utility

Get Payment MethodGETGet Transfer ChannelGETGet Account BalanceGET

Signature

Generating Signature

Payment

Generate Accept PaymentPOST

Transfer

Transfer InquiryPOSTTransfer PaymentPOST

Topup

Topup RequestPOST

Check Status

Check Payment StatusGETCheck Transfer StatusGETCheck Topup StatusGET

Callback

Payment CallbackTransfer CallbackTopup Callback

Additional Things

Response CodePayment and Topup StatusTransfer StatusRedirect Payment URL

Signature

Generating Signature

This page will guide you on how generating the signature for all API activity.

Signature Overview

Kindly ensure the data is encrypted using the specified algorithm before including it in your request.

Symetric-Signature With SHA_256

HMAC_SHA256(youClientSecret, stringToSign) with hex encoding

String To Sign
// GET METHOD
stringToSign = <HTTP METHOD> + ":" + <RELATIVE PATH URL> + ":" + <X-TIMESTAMP>

// POST METHOD
stringToSign = <HTTP METHOD> + ":" + <RELATIVE PATH URL> + ":" + LowerCase(HexEncode(SHA-256(Minify(<HTTP BODY>)))) + ":" + <X-TIMESTAMP>

Example GETMethod (Typescript)

Symetric-Signature With SHA_256

Example
const clientSecret = "abc"
const timestamp = Date.now()

const stringToSign = "POST" + ':' + "/v1/utility/payment/channel" + ":" + timestamp

const layer1Sig = crypto.createHmac('sha256', clientSecret).update(stringToSign).digest('hex');

//Result:
//fc01508909434c5f3544f80c6937f79f8271e1db4a94682dbd5ad20e85b86868

If the 2nd layer of protection is enabled for the API request, please ensure the data is encrypted once more using your private key before submission.

Example 2nd layer encryptionGETMethod (Typescript)

Asymmetric-Signature With RSA-SHA256

RSA-SHA256
const privKey = crypto.createPrivateKey("YOUR_PRIVATE_KEY");

const layer2Sig = crypto.sign("RSA-SHA256", Buffer.from(layer1Sig), privKey)
                        .toString("base64")

After you encrypt the signature, you MUST put it in the header for your request.

You can take a look at the header for every endpoint for the requirement.

Note: For Transfer Payment API, there will be a slight difference in the stringToSign.

You must make a request on the Transfer Inquiry API first. Then you will get a inquiryRef in the response. After that, you can do the hashing like this to be put in the header on the Transfer Payment API.

Example (Typescript)

Symetric-Signature With SHA_512

Transfer Payment Signature
const clientSecret = "abc"
const timestamp = Date.now()

const stringToSign = "POST" + ':' + "/v1/generate/transfer/payment" + ":" + LowerCase(HexEncode(SHA-256(Minify(<HTTP BODY>)))) + ":" + timestamp + ":" + inquiryRef

// An Inquiry Ref will be provided from Transfer Inquiry API, which must be included when invoking the Transfer Payment API.
// Then the rest will be same

If you require further assistance or have any questions, please do not hesitate to reach out to our support team. 🍻