# SNAP / QRIS Request Signer

> Build the stringToSign and X-SIGNATURE for Indonesian payment APIs. Handles the B2B token and transactional forms.

URL: https://uttir.com/snap-string-to-sign
Categories: developer-tools, security-tools
Privacy: Everything — the private key, the request body, the signature — is processed in this browser tab. Nothing is uploaded and nothing is stored.

## About

Indonesian payment providers (BRI, OneBrick, YUKK, Paydia, OVO, Doku, Nicepay, Payermax) all sign requests the same way, and all of them document it slightly differently. This tool assembles the exact string, hashes the body the way the acquirer does, and signs it.

Two forms are supported. The B2B access-token request signs clientID + "|" + timestamp. A transactional request signs method + ":" + path + ":" + lowercase-hex SHA-256 of the minified body + ":" + timestamp.

## How to use

1. **Pick the request type** — Access token (clientID|timestamp) or transactional (method:path:bodyHash:timestamp).
2. **Fill in the fields** — Method, path, body and timestamp for a transaction.
3. **Paste your private key** — PKCS#8 or PKCS#1, converted automatically.
4. **Copy X-SIGNATURE** — The stringToSign and body hash are shown too, so you can check them.

## FAQ

### What exactly is minified here?

Whitespace outside string values is removed, and key order is left exactly as written. The tool shows you the minified body it hashed, so you can send those exact bytes and be certain the acquirer hashes the same thing.

### Which timestamp format is right?

Local time with an explicit UTC offset and no milliseconds, like 2026-07-29T10:00:00+07:00. The same value must go in the X-TIMESTAMP header and in the string you sign — the tool fills it in for you.

### My signature is still rejected. What else can it be?

Check the path: it must be the relative path, not the full URL. Check the body: it must be the same bytes the acquirer receives, and it must be minified the same way. And check the key — a PKCS#1 key needs converting, which this tool does for you.

### Does this call the payment API?

No. It only builds and signs the values. Nothing is sent to any provider, and no request is made on your behalf.

## Related tools

- [RSA Signature Generator (SHA256withRSA)](https://uttir.com/rsa-sign) — Sign a string with your RSA private key and get the Base64 signature. Accepts PKCS#8 and PKCS#1 keys.
- [RSA Signature Verifier](https://uttir.com/rsa-verify) — Check whether a Base64 RSA signature is valid for a message and public key. SHA256withRSA and PSS supported.
- [RSA Key Generator](https://uttir.com/rsa-keygen) — Generate an RSA key pair in your browser. 2048, 3072 or 4096 bits, exported as PEM — nothing is uploaded.
- [Hash Generator](https://uttir.com/hash-generator) — Generate MD5, SHA-1, SHA-256, and SHA-512 hashes of any text instantly.

---

For the full HTML page with the live tool, visit https://uttir.com/snap-string-to-sign.
This file is the markdown rendering at https://uttir.com/snap-string-to-sign.md. See https://uttir.com/llms.txt for a site-wide summary.