Signature Generation Guide

using System.Net.Http;
using System.Security.Cryptography;
using System.Text;
using System.Text.Json;
using System.Text.Json.Nodes;

public static class C2CSigner
{
    /// <summary>Adds the "signature" field to the payload and returns the JSON string to send.</summary>
    public static string SignBody(JsonObject payload, string signingSecret)
    {
        using var document = JsonDocument.Parse(payload.ToJsonString());
        var parameters = new SortedDictionary<string, string>(StringComparer.Ordinal);   // ASCII order

        foreach (var property in document.RootElement.EnumerateObject())
        {
            if (property.Name.Equals("signature", StringComparison.OrdinalIgnoreCase))
                continue;

            var value = property.Value.ValueKind switch
            {
                JsonValueKind.String => property.Value.GetString(),
                JsonValueKind.Number => property.Value.GetRawText(),   // exactly as written in the body
                JsonValueKind.True => "true",
                JsonValueKind.False => "false",
                _ => null,                                             // null, objects and arrays are not signed
            };
            if (!string.IsNullOrEmpty(value))
                parameters[property.Name.ToLowerInvariant()] = value;
        }

        var queryString = string.Join("&", parameters.Select(p => $"{p.Key}={p.Value}"));
        var hash = MD5.HashData(Encoding.UTF8.GetBytes(queryString + signingSecret));
        payload["signature"] = Convert.ToHexString(hash).ToLowerInvariant();
        return payload.ToJsonString();
    }
}

// Usage: create a deposit order
var baseUrl = "https://api.c2cpayment.net";
var payload = new JsonObject
{
    ["orderType"] = "Deposit",
    ["amount"] = 1500,
    ["currency"] = "PKR",
    ["walletType"] = "JazzCash",
    ["merchantOrderRef"] = "INV-10045",
    ["customerReference"] = "player_12345",
    ["callbackUrl"] = "https://merchant.example.com/webhooks/c2c",
};
var body = C2CSigner.SignBody(payload, Environment.GetEnvironmentVariable("C2C_SIGNING_SECRET")!);

using var http = new HttpClient();
using var request = new HttpRequestMessage(HttpMethod.Post, baseUrl + "/api/merchant/orders")
{
    Content = new StringContent(body, Encoding.UTF8, "application/json"),
};
request.Headers.Add("C2C-API-Key", Environment.GetEnvironmentVariable("C2C_API_KEY"));
request.Headers.Add("Idempotency-Key", "INV-10045");

var response = await http.SendAsync(request);
Console.WriteLine(await response.Content.ReadAsStringAsync());

const crypto = require('crypto');

function signBody(payload, signingSecret) {
  const params = Object.entries(payload)
    .filter(([key, value]) =>
      key.toLowerCase() !== 'signature' &&
      value !== null && value !== undefined && value !== '' &&
      typeof value !== 'object')                                  // objects and arrays are not signed
    .map(([key, value]) => [key.toLowerCase(), String(value)])   // true → "true", 1500.5 → "1500.5"
    .sort(([a], [b]) => (a < b ? -1 : a > b ? 1 : 0));           // ASCII order of the lowercase keys

  const queryString = params.map(([key, value]) => `${key}=${value}`).join('&');
  return crypto.createHash('md5').update(queryString + signingSecret, 'utf8').digest('hex');
}

// Usage: create a deposit order (Node 18+ global fetch)
const baseUrl = 'https://api.c2cpayment.net';
const payload = {
  orderType: 'Deposit',
  amount: 1500,
  currency: 'PKR',
  walletType: 'JazzCash',
  merchantOrderRef: 'INV-10045',
  customerReference: 'player_12345',
  callbackUrl: 'https://merchant.example.com/webhooks/c2c',
};

const response = await fetch(`${baseUrl}/api/merchant/orders`, {
  method: 'POST',
  headers: {
    'C2C-API-Key': process.env.C2C_API_KEY,
    'Content-Type': 'application/json',
    'Idempotency-Key': 'INV-10045',
  },
  body: JSON.stringify({ ...payload, signature: signBody(payload, process.env.C2C_SIGNING_SECRET) }),
});
console.log(response.status, await response.json());

import hashlib
import os

import requests


def sign_body(payload: dict, signing_secret: str) -> str:
    params = {}
    for key, value in payload.items():
        if key.lower() == "signature" or value is None or value == "" or isinstance(value, (dict, list)):
            continue  # objects and arrays are not signed
        if isinstance(value, bool):
            value = "true" if value else "false"  # bool before int: True is an int in Python
        params[key.lower()] = str(value)

    query_string = "&".join(f"{key}={params[key]}" for key in sorted(params))  # ASCII order
    return hashlib.md5((query_string + signing_secret).encode("utf-8")).hexdigest()


# Usage: create a deposit order
base_url = "https://api.c2cpayment.net"
payload = {
    "orderType": "Deposit",
    "amount": 1500,
    "currency": "PKR",
    "walletType": "JazzCash",
    "merchantOrderRef": "INV-10045",
    "customerReference": "player_12345",
    "callbackUrl": "https://merchant.example.com/webhooks/c2c",
}

response = requests.post(
    f"{base_url}/api/merchant/orders",
    json={**payload, "signature": sign_body(payload, os.environ["C2C_SIGNING_SECRET"])},
    headers={
        "C2C-API-Key": os.environ["C2C_API_KEY"],
        "Idempotency-Key": "INV-10045",
    },
)
print(response.status_code, response.json())