Signing the URL

The Pay Widget is configured by URL query parameters. Two of them identify you:

1. source — the "Source" value from your merchant dashboard.

2. signature — a JWT signed with a URL signature secret from your merchant dashboard.

Generating the signature

Sign a JWT with the HS256 algorithm, using your URL signature secret as the key. Put a unique value in the payload so each token is distinct. During testing you can generate one at https://jwt.io/.

You can also carry widget configuration parameters in the token payload instead of the query string, which keeps them out of the visible URL.

import * as jsonwebtoken from 'jsonwebtoken';
import { v4 as uuid } from 'uuid';

const signature = jsonwebtoken.sign(
    {
      uid: uuid(),
    },
    YOUR_SIGNATURE_SECRET,
    {
      algorithm: 'HS256',
    },
 );

The secret is a signing key. It belongs on your server — never in client-side code, and never in the URL itself. You can create and rotate secrets from the dashboard.

With source and signature in hand, move on to URL params to configure the widget.