> ## Documentation Index
> Fetch the complete documentation index at: https://docs.paycashless.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

All requests require an API key passed in the Authorization header using the bearer authentication scheme. You can get your key from the Paycashless dashboard [here](https://dashboard.Paycashless.com/developers):

```
Authorization: Bearer <YOUR_API_KEY>
```

### Request Signing

<Info>Check the [Signing API requests](/api-signature) page for a detailed guide on how sign your API requests.</Info>

To protect the integrity of your API requests, Paycashless uses signature authentication. This ensures that each request is securely verified and that the data hasn’t been altered in transit.

By generating a signature with your API secret using HMAC-SHA512, we’re able to validate both the authenticity and integrity of every request sent to our servers.

Each request's header therefore must include:

1. `Request-Timestamp`: Unix timestamp in seconds
2. `Request-Signature`: HMAC-SHA512 signature

A `Request-Signature` is generated using:

1. The request path
2. A hash of the sorted request body (for POST requests)
3. UNIX timestamp in seconds

### Example

<CodeGroup>
  ```js request_signature.js theme={null}
  import crypto from 'crypto';
  import { sortObjectAlphabetically } from "./sort.js";

  function sha512Sign(message, secret) {
    return crypto.createHmac('sha512', secret).update(message).digest('hex');
  }

  // Get the timestamp (in seconds) and pass it to the header as 'Request-Timestamp'
  const timestamp = Math.floor(Date.now() / 1000);
  const requestPath = "/v1/payouts";
  const API_SECRET = "YOUR_API_SECRET"; // replace these with your actual API secret value

  // Get the request body 
  let body = {
    "amount":{
      "currency":"NGN",
      "value":10000
    },
    "bankId":"bank_538ed2056326432ba8e6853b613997bb",
    "callbackUrl":"https://webhook.site/99a59e8a-bd0b-485d-8249-fccb5eb62e27",
    "destinationAccountNumber":"9845648577",
    "metadata":{
      "category":"transfer"
    },
    "narration":"zapped",
    "reference":"trx_fWQ7b31pbs5mmT3k3qfb46"
  };

  // Sort the body alphabetically
  body = sortObjectAlphabetically(body);

  // Create the body hash to be passed as payload
  const bodyHash = sha512Sign(JSON.stringify(body), API_SECRET);

  // Concatenate the string to sign
  const stringToSign = `${requestPath}${bodyHash}${timestamp}`;

  // Generate the Request-Signature value for the header
  const signature = sha512Sign(stringToSign, API_SECRET);

  console.log(`signature: ${signature}`);
  ```

  ```js sort.js theme={null}
  export function sortObjectAlphabetically(obj) {
    if (!obj || typeof obj !== 'object' || Array.isArray(obj)) {
      return obj;
    }

    const sortedKeys = Object.keys(obj).sort();
    const sortedObj = {};

    // Add each property to the new object in alphabetical order
    sortedKeys.forEach(key => {
      // Recursively sort nested objects
      if (typeof obj[key] === 'object' && !Array.isArray(obj[key]) && obj[key] !== null) {
        sortedObj[key] = sortObjectAlphabetically(obj[key]);
      } else {
        sortedObj[key] = obj[key];
      }
    });

    return sortedObj;
  }
  ```
</CodeGroup>