LintasPay Verifying signatures
LintasPay signs every API response and every callback with its private key. Verify the signature with the LintasPay public key before you trust the content.
Signature headers
| Header | Meaning |
|---|---|
lintaspay-signature | Base64 SHA256withRSA signature |
lintaspay-timestamp | Unix time in milliseconds |
lintaspay-nonce | Random string |
lintaspay-trace-id | LintasPay request id. Include it when you contact support. Responses only. |
Content to verify
The content is three lines, each ending with \n:
<lintaspay-timestamp>\n
<lintaspay-nonce>\n
<raw response or callback body>\n
Verify over the raw body bytes, before you parse the JSON.
The helpers on Signing requests already verify responses. The same check for callbacks is on Callbacks.
If verification fails
Don't act on the message.
- API responses: treat the outcome as unknown and query the order again.
- Callbacks: reply with a non-200 status. LintasPay retries, and you can always query the order.