Signature

All requests to GLODIPAY are signed, and everything GLODIPAY sends back (responses, redirects, webhooks) is signed so you can verify it.

Signatures use RSA with MD5 (md5WithRSAEncryption). Your RSA Private Key and the GLODIPAY RSA Public Key are on the API Keys page of the Merchant Dashboard.

This page describes signature version 2.1: you sign the exact JSON string you send. There is nothing to sort, filter or escape.

Using the previous scheme?

Requests without signVersion are still verified with the 2.0 rules. Both versions use the same keys.

---

Sending a request (Merchant → GLODIPAY)

1. Put the request fields in a JSON string: payload = JSON.stringify(fields).
2. Sign that string with your RSA Private Key: signature = base64(md5WithRSA(payload)).
3. Send three fields — as a JSON body or as form fields:

{
  "signVersion": "2.1",
  "payload": "{\"merchantId\":\"1100000123\",\"orderRef\":\"ORDER-001\",\"amount\":\"100.50\",\"currency\":\"USD\"}",
  "signature": "kQ3x…base64…"
}

The fields inside payload are the same request fields listed for each endpoint. GLODIPAY verifies the signature on the exact payload string it receives, so any JSON encoder works.

---

Verifying what GLODIPAY sends (GLODIPAY → Merchant)

Responses, redirects and webhooks come in the same shape: signVersion, payload (a JSON string) and signature. Verify signature against the payload string with the GLODIPAY RSA Public Key, then JSON.parse(payload) to read the data. For redirects, the payload query parameter is Base64 — decode it first to get this object.

Your account switches to 2.1 automatically after GLODIPAY accepts its first 2.1 request; from then on everything GLODIPAY sends you uses this shape. Accounts that never send signVersion stay on 2.0.

---

Code Examples

PHP

<?php

function signPayload(array $fields, string $privateKeyPem): array
{
    $payload = json_encode($fields);
    openssl_sign($payload, $signature, openssl_pkey_get_private($privateKeyPem), 'md5WithRSAEncryption');

    return ['signVersion' => '2.1', 'payload' => $payload, 'signature' => base64_encode($signature)];
}

function verifyBody(array $body, string $publicKeyPem): bool
{
    return openssl_verify($body['payload'], base64_decode($body['signature']), openssl_pkey_get_public($publicKeyPem), 'md5WithRSAEncryption') === 1;
}

$body = signPayload([
    'merchantId' => '1100000123',
    'orderRef'   => 'ORDER-001',
    'amount'     => '100.50',
    'currency'   => 'USD',
], $privateKeyPem);
// POST $body as JSON or form fields.

// Webhook: $body = json_decode(file_get_contents('php://input'), true);
//          if (verifyBody($body, $glodipayPublicKeyPem)) { $data = json_decode($body['payload'], true); }

Node.js

import { createSign, createVerify } from 'crypto';

function signPayload(fields, privateKeyPem) {
    const payload = JSON.stringify(fields);
    const signature = createSign('md5WithRSAEncryption').update(payload).sign(privateKeyPem, 'base64');
    return { signVersion: '2.1', payload, signature };
}

function verifyBody(body, publicKeyPem) {
    return createVerify('md5WithRSAEncryption').update(body.payload).verify(publicKeyPem, body.signature, 'base64');
}

const body = signPayload({
    merchantId: '1100000123',
    orderRef: 'ORDER-001',
    amount: '100.50',
    currency: 'USD',
}, PRIVATE_KEY);
// POST body as JSON or form fields.

// Webhook: if (verifyBody(req.body, GLODIPAY_PUBLIC_KEY)) { const data = JSON.parse(req.body.payload); }

The Signature Tool signs and verifies any payload in the browser.

---

Migrating from 2.0

Nothing changes for an existing integration until it sends signVersion: "2.1". To move:

1. Webhook handler first. Accept both shapes: a body with payload is 2.1 (verify with verifyBody), anything else is 2.0. The first 2.1 request switches your account, so the handler must be ready before that request.
2. Then requests. Send signPayload(fields) instead of the signed flat fields.
3. The switch is one-way — sending 2.0 requests again does not move GLODIPAY's outgoing payloads back to 2.0.