SNAP BI Asymmetric Signature Guide
Build, sign and verify the SHA256withRSA signature used by Bank Indonesia's SNAP BI standard.
A short companion for SNAP BI Asymmetric Signature: when it is useful, what it expects, and what to check before using the result.
What it does
A workbench for the asymmetric signature in Bank Indonesia's SNAP BI standard, the scheme banks and payment providers use for API requests and notifications. It builds the string to sign from the HTTP method, endpoint, a SHA-256 hash of the minified body and the X-TIMESTAMP, then signs it with an RSA private key or verifies it with the sender's public key. Both operations run in the browser with the Web Crypto API.
Use the tool
Open SNAP BI Asymmetric Signature, add the input the tool asks for, run it, and check the output before using it elsewhere.
Input and output
- Input: text.
- Output: text.
- Category: Network.
Privacy and processing
Processing happens locally in your browser. This tool does not upload the input to ilham.dev.
Questions
What exactly is the string that gets signed?
HTTPMethod + ':' + EndpointUrl + ':' + lowercase(hex(SHA-256(minify(body)))) + ':' + X-TIMESTAMP. The method is upper-cased, the body is minified JSON, and its SHA-256 is written as lowercase hex. Join the four parts with colons and sign that exact string.
Which key goes where?
Signing uses the private key of the sender. Verification uses the public key of the sender, not yours. For a notification you received, the sender is the payment provider, so paste the public key they published.
Why is the body minified before hashing?
The signature must not depend on cosmetic whitespace, so both sides agree to strip it first. JSON.stringify(JSON.parse(body)) removes the formatting and the receiver hashes the same compact form. If the body is not valid JSON it is hashed as typed.
Is this the same as SHA256withRSA in Java or Node?
Yes. Web Crypto's RSASSA-PKCS1-v1_5 with SHA-256 is exactly SHA256withRSA, so a signature made here verifies in Java, Node or any SNAP BI library, and the other way round.
Can I use a production private key here?
Technically yes, but do not. This is a public web page, so paste a test key, or press Generate key pair to create a throwaway 2048-bit pair and try the flow end to end.
Related guide
For broader background, see Security and Cryptography Basics for Developers.