> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://docs.yukbayarin.asia/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs.yukbayarin.asia/_mcp/server.

# Authentication

Autentikasi diperlukan di semua Endpoint saat berinteraksi melalui koneksi API.

## Authorization

Setiap request ke Service API wajib menyertakan `client_id`, `x-username`, `x-timestamp` dan `x-signature` di header request. Berikut adalah detail **Autentikasi Header** yang diperlukan:

| Key             | Value              | Required | Deskripsi                                                   |
| :-------------- | :----------------- | :------: | :---------------------------------------------------------- |
| **client_id**   | `{{client_id}}`    |     ✅    | Client ID Merchant                                          |
| **x-username**  | `{{api_username}}` |     ✅    | Username H2H                                                |
| **x-timestamp** | *auto-generated*   |     ✅    | Waktu request, format ISO 8601 (`new Date().toISOString()`) |
| **x-signature** | *auto-generated*   |     ✅    | Lihat rumus & contoh untuk [Generate Signature](#signature) |

\


💡**NOTE:** Lakukan semua permintaan API melalui HTTPS. Permintaan API tanpa otentikasi akan gagal.

**`Example Header`**

```bash title="Example Header"
curl -X POST 'https://sandbox.yukbayarin.asia/v1/transaction/transfer-inquiry' \
  -H 'client_id: {{client_id}}' \
  -H 'x-username: {{api_username}}' \
  -H 'x-timestamp: {{x-timestamp}}' \
  -H 'x-signature: {{x-signature}}'
```

---

## Signature

Rumus Signature

key       = SHA1(API_key + api_username)
signature = HMAC_SHA256(api_password + path + x-timestamp, key)

\


💡**NOTE:** path adalah path url tanpa query string, **example:** v1/transaction/transfer-inquiry

**`Example to generate Signature`**

```json Example to generate Signature maxLines=11
const api_key = pm.variables.get('API_key');
const pass_h2h = pm.variables.get('api_password');
const username = pm.request.headers.get('x-username');
const datetime = pm.request.headers.get('x-timestamp');
const path = '/' + pm.request.url.getPath({ unresolved: false }).replace(/^\/+/, '');
const key = CryptoJS.SHA1(api_key + username).toString(CryptoJS.enc.Hex);
const data = pass_h2h + path + datetime;
const signature = CryptoJS.HmacSHA256(data, key).toString(CryptoJS.enc.Hex);

pm.request.headers.upsert({ key: 'x-signature', value: signature });
```

> **Warning**
>
> Untuk mendapatkan data **API Key, Username & Password** lihat di [Credential API](credential_api)