Request Signing

Each request to the Prodege MR API must be signed. The signature is based on the following formula, where StringToSign consists of all request parameters sorted alphabetically by key and concatenated using a colon (:). Base64( SHA256( UTF-8-Encoding-Of(SecretKey + ":" + StringToSign) ) ) For example: For a request to /project-create with parameters: apik=yBnXUjjiXSXZ, country_id=1, loi=10, project_id=2025, project_name=Test Survey, project_type_id=1, project_url=https://google.com/%transid%/, and request_date=1442254164458, the StringToSign would be:

apik=yBnXUjjiXSXZ:country_id=1:loi=10:project_id=2025:project_name=Test Survey:project_type_id=1:project_url=https://google.com/%transid%/:request_date=1442254164458

The signature is generated as:

Base64( SHA256( UTF-8-Encoding-Of(SecretKey + ":" + StringToSign) ) )

Note: Since the SHA256 output is Base64-encoded and may contain URL-unsafe characters, the following replacements must be applied before sending:

Character	Replacement
+	-
/	_
=	EMPTY STRING

In Java:

static String getProdegeMRSignature(String stringToSign, String secretKey)
{
    byte[] utf8Bytes = (secretKey + ":" + stringToSign).getBytes("UTF-8");
    MessageDigest digest = MessageDigest.getInstance("SHA-256");
    byte[] hash = digest.digest(utf8Bytes);
    byte[] base64Hash = Base64.encodeBase64(hash);
    String signature = new String(base64Hash).replace("+", "-")
                                             .replace("/", "_")
                                             .replace("=", "");
    return signature;
}

In C#:

static string GetProdegeMRSignature(string stringToSign, string secretKey)
{
    var bytes = Encoding.UTF8.GetBytes(secretKey + ":" + stringToSign);
    var algo = new SHA256Managed();
    var hashBytes = algo.ComputeHash(bytes);
    var base64String = System.Convert.ToBase64String(hashBytes);
    var result = base64String.Replace("+", "-")
                             .Replace("/", "_")
                             .Replace("=", "");
    return result;
}

In PHP:

function getProdegeMRSignature($stringToSign, $secretKey)
{
    $utf8_encoded   = utf8_encode($secretKey . ":" . $stringToSign);
    $sha256_hash    = hash('sha256', $utf8_encoded, true);
    $base64_encoded = base64_encode($sha256_hash);
    $signature      = str_replace("+", "-",
                          str_replace("/", "_",
                          str_replace("=", "", $base64_encoded)));
    return $signature;
}

In Python:

from hashlib import sha256
from base64 import b64encode

def get_prodegemr_signature(string_to_sign: str, secret_key: str) -> str:
    utf8_encoded = f"{secret_key}:{string_to_sign}".encode("UTF-8")
    hashed = sha256(utf8_encoded).digest()
    base64_encoded = b64encode(hashed).decode("UTF-8")
    return base64_encoded.replace("+", "-").replace("/", "_").replace("=", "")