After merchant send request to DOKU and generate signature in request header, DOKU will send response and generate signature in response header. Then merchant can verify this response is coming from DOKU by Signature.1.
Arrange the signature components to one component and its value per line by adding escape character. Don't add at the end of the string. Sample of the raw format:
2.
Calculate HMAC-SHA256 base64 from all the components above using the Secret Key from DOKU Back Office
3.
Put encoded value and prepend HMACSHA256= to the Signature. Sample:
To make sure every response API from DOKU, just verify in Signature that you get from Response Header!
Modified at 2026-08-31 09:26:51
