---
updatedAt: 2025-05-20T21:54:03.000Z
agentTools:
  projectIndex: https://shop-and-pay.readme.io/llms.txt
---

# Check your signature

This endpoint can be used to verify the INSTANCE\_API\_SECRET to be correct. In case it is not correct, you get an error status.

# OpenAPI definition

```json
{
  "openapi": "3.1.0",
  "info": {
    "title": "api-settings",
    "version": "1.0"
  },
  "servers": [
    {
      "url": "https://api.shop-and-pay.com/v1.0"
    }
  ],
  "security": [
    {}
  ],
  "paths": {
    "/SignatureCheck/": {
      "get": {
        "summary": "Check your signature",
        "description": "",
        "operationId": "signaturecheck",
        "parameters": [
          {
            "name": "instance",
            "in": "query",
            "description": "Your Shop & Pay instance name",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "description": "200",
            "content": {
              "application/json": {
                "examples": {
                  "Raw": {
                    "value": "{\"status\":\"success\",\"data\":[{\"id\":1}]}"
                  }
                },
                "schema": {
                  "type": "object",
                  "properties": {
                    "status": {
                      "type": "string",
                      "example": "success"
                    },
                    "data": {
                      "type": "array",
                      "items": {
                        "type": "object",
                        "properties": {
                          "id": {
                            "type": "integer",
                            "example": 1,
                            "default": 0
                          }
                        }
                      }
                    }
                  }
                }
              }
            }
          }
        },
        "deprecated": false,
        "x-readme": {
          "code-samples": [
            {
              "language": "curl",
              "code": "apiSignature=`echo -n \"\" | openssl dgst -sha256 -hmac \"INSTANCE_API_SECRET\" -binary | openssl enc -base64`\ncurl --request GET \"https://api.shop-and-pay.com/v1.0/SignatureCheck/?instance=INSTANCE_NAME\" --data-urlencode \"ApiSignature=$apiSignature\""
            },
            {
              "language": "php",
              "code": "<?php\n// $instanceName is a part of the url where you access your shopandpay installation.\n// https://{$instanceName}.shop-and-pay.com\n$instanceName = 'INSTANCE_NAME';\n\n// $secret is the shopandpay secret for the communication between the applications\n// if you think someone got your secret, just regenerate it in the shopandpay administration\n$secret = 'INSTANCE_API_SECRET';\n\n$shopandpay = new \\shopandpay\\shopandpay($instanceName, $secret);\n\n$signatureCheck = new \\shopandpay\\Models\\Request\\SignatureCheck();\ntry {\n    $response = $shopandpay->getOne($signatureCheck);\n    die('Signature correct');\n} catch (\\shopandpay\\shopandpayException $e) {\n    print $e->getMessage();\n  \tdie('Signature wrong');\n}"
            },
            {
              "language": "python",
              "code": "import urllib.request\nimport hmac\nimport hashlib\nimport base64\nimport sys\n\npost_data = {}\n\ndata = urllib.parse.urlencode(post_data).encode('UTF-8')\n\ndig = hmac.new(b'INSTANCE_API_SECRET', msg=data, digestmod=hashlib.sha256).digest()\npost_data['ApiSignature'] = base64.b64encode(dig).decode()\npost_data['instance'] = 'INSTANCE_NAME'\n\ndata = urllib.parse.urlencode(post_data, quote_via=urllib.parse.quote).encode('UTF-8')\n\ntry:\n    result = urllib.request.urlopen('https://api.shop-and-pay.com/v1.0/SignatureCheck/?' + data.decode())\n    sys.exit(\"Signature correct\")\nexcept Exception as exc:\n    print(exc, file=sys.stderr)\n    sys.exit(\"Signature wrong\")"
            },
            {
              "language": "java",
              "code": "// imports\nimport javax.crypto.Mac;\nimport javax.crypto.spec.SecretKeySpec;\nimport java.io.UnsupportedEncodingException;\nimport java.net.URLEncoder;\nimport java.util.Base64;\nimport java.util.HashMap;\nimport java.util.concurrent.atomic.AtomicReference;\n\npublic static void main(String[] args) {\n  // method content\n  String key = \"API-SECRET\";\n\n  // set up api data\n  HashMap<String, String> data = new HashMap<>();\n  data.put(\"title\", \"Test\");\n  data.put(\"description\", \"Test\");\n  data.put(\"referenceId\", \"12345678\");\n  data.put(\"purpose\", \"Test\");\n  data.put(\"amount\", \"200\");\n  data.put(\"currency\", \"EUR\");\n\n  String payload = getPayload(data);\n  String hash = getApiSignature(payload, key);\n\n  // append calculated ApiSignature to form data\n  try {\n    payload += \"&ApiSignature=\" + URLEncoder.encode(hash, \"UTF-8\");\n  } catch (Exception e) {}\n\n  payload = payload.replace(\"+\", \"%20\");\n\n  System.out.println(\"ApiSignature: \" + hash);\n  System.out.println(\"Payload: \" + payload);\n}\n\nprivate static String getApiSignature(String encodedData, String apiKey) {\n  try {\n    Mac sha256_HMAC = Mac.getInstance(\"HmacSHA256\");\n    SecretKeySpec secret_key = new SecretKeySpec(apiKey.getBytes(\"UTF-8\"), \"HmacSHA256\");\n    sha256_HMAC.init(secret_key);\n    return Base64.getEncoder().encodeToString(sha256_HMAC.doFinal(encodedData.getBytes(\"UTF-8\")));\n  } catch (Exception e) {}\n  return \"\";\n}\n\nprivate static String getPayload(HashMap<String, String> postData) {\n  AtomicReference<String> urlEncoded = new AtomicReference<>(\"\");\n  postData.forEach((s, s2) -> {\n    try {\n      String concat = urlEncoded.get().isEmpty() ? \"\" : \"&\";\n      urlEncoded.set(urlEncoded.get() + concat + URLEncoder.encode(s, \"UTF-8\") + \"=\" + URLEncoder.encode(s2, \"UTF-8\"));\n    } catch (UnsupportedEncodingException e) {\n    }\n  });\n\n  return urlEncoded.get();\n}"
            },
            {
              "language": "csharp",
              "code": "# head\nusing System.Text;\nusing System.Security.Cryptography;\n\n# function\nstring key = \"API-SECRET\";\nstring message = \"data1=value1&data2=value2\";\n\nbyte[] keyByte = new UTF8Encoding().GetBytes(key);\nbyte[] messageBytes = new UTF8Encoding().GetBytes(message);\nbyte[] hashmessage = new HMACSHA256(keyByte).ComputeHash(messageBytes);\n\nvar signature = Convert.ToBase64String(hashmessage);"
            }
          ],
          "samples-languages": [
            "curl",
            "php",
            "python",
            "java",
            "csharp"
          ]
        }
      }
    }
  },
  "x-readme": {
    "headers": [],
    "explorer-enabled": false,
    "proxy-enabled": true
  },
  "x-readme-fauxas": true
}
```