> ## Documentation Index
> Fetch the complete documentation index at: https://docs.payfi.global/llms.txt
> Use this file to discover all available pages before exploring further.

# Signing Requests

> HMAC signature contract for partner API calls.

Required headers:

```http theme={null}
X-PayFi-Api-Key: pfk_test_...
X-PayFi-Nonce: random-128-bit-value
X-PayFi-Signature: t=1779100000000,h=<sha256_raw_body_hex>,v1=<hmac_hex>
Idempotency-Key: partner-write-key
```

Canonical payload:

```text theme={null}
payfi-v1
<timestamp_ms>
<nonce>
<METHOD>
<path_and_query>
<sha256_raw_body_hex>
```

`v1` is `HMAC_SHA256(privateSecret, canonicalPayload)` encoded as lowercase hex. PayFi rejects timestamp skew over five minutes and rejects nonce reuse.

Sign the exact request path and query string sent to PayFi. For example, a request to list operations with filters signs `/v1/operations?status=ACTION_REQUIRED&page=1`, not just `/v1/operations`.