Signing Requests

Required headers:

X-PayFi-Api-Key: pfk_test_...
X-PayFi-Nonce: random-128-bit-value
X-PayFi-Signature: t=1779100000000,h=<sha256_raw_body_hex>,v1=<hmac_hex>
Idempotency-Key: partner-write-key

Canonical payload:

payfi-v1
<timestamp_ms>
<nonce>
<METHOD>
<path_and_query>
<sha256_raw_body_hex>

v1 is HMAC_SHA256(privateSecret, canonicalPayload) encoded as lowercase hex. PayFi rejects timestamp skew over five minutes and rejects nonce reuse. Sign the exact request path and query string sent to PayFi. For example, a request to list operations with filters signs /v1/operations?status=ACTION_REQUIRED&page=1, not just /v1/operations.

API Keys Idempotency

Integration

Trust and release

Authentication