HTTP Headers Reference

Halaman ini menjelaskan header wajib untuk autentikasi HMAC.

Required headers

Selalu kirim:

• Authorization
• X-Date
• X-Request-Id
• X-Client-Type

Jika CredentialType=user, juga kirim:

• X-Tenant-Id

Authorization format

HMAC-SHA256 CredentialType={type}, CredentialId={id}, SignedHeaders={headerList}, Signature={hexSignature}

Service example

HMAC-SHA256 CredentialType=service, CredentialId=external-system-client, SignedHeaders=x-date;x-request-id;x-client-type, Signature=<hex>

User example

HMAC-SHA256 CredentialType=user, CredentialId=admin@example.com, SignedHeaders=x-date;x-tenant-id;x-request-id;x-client-type, Signature=<hex>

Header order rules

SignedHeaders harus mengikuti urutan server:

• service: x-date;x-request-id;x-client-type
• user: x-date;x-tenant-id;x-request-id;x-client-type

Best practices

• Gunakan new Date().toISOString() untuk X-Date.
• Gunakan UUID baru setiap request.
• Untuk retry, tetap gunakan request ID baru.

Next

• Signature Generation
• Error Reference