Reference

Signature playground

Paste a secret and a body to see the exact signature Perx expects, or check one your code produced. Everything runs in your browser — nothing is sent anywhere.

Use a UAT secret

This page makes no network requests and stores nothing, but there is no reason to paste a production secret into a web page. Use a UAT connection secret.

Connection secretThe 64-character hex string from the merchant's Perx dashboard.X-Perx-TimestampUnix epoch seconds. Not milliseconds.

Raw request bodyThe exact bytes you transmit — same whitespace, same key order.

Expected X-Perx-Signature

Enter a secret to compute…

Compare against your signatureOptional — paste what your code produced and this will tell you how it differs.

What this computes

The signing string is the timestamp, a literal period, then the raw body. The result is base64 of the HMAC-SHA256 digest, prefixed v1=.

signingString = X-Perx-Timestamp + "." + rawRequestBody
signature     = "v1=" + base64( HMAC_SHA256( signingString, connectionSecret ) )

If your signature does not match

In rough order of how often each one turns out to be the cause:

The body was re-serialised after signing. Serialising, signing, then serialising again to send produces different bytes — different key order, whitespace or unicode escaping. Serialise once into a buffer, sign that buffer, send that buffer.
Milliseconds instead of seconds in the timestamp.
The timestamp was not included in the signing string, or the period was omitted.
Hex instead of base64 — a very common default in HMAC libraries.
The v1= prefix is missing from the header value.
Trailing whitespace or a newline on the secret, usually from a copy-paste or a .env file.
The merchant rotated the secret and your stored copy is stale.