> For the complete documentation index, see [llms.txt](https://developer.prodege.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://developer.prodege.com/demand/authentication/request-signing.md).

# Request Signing

Each request to the Prodege MR API must be signed. The signature is based on the following formula, where *StringToSign* consists of all request parameters sorted alphabetically by key and concatenated using a colon (`:`). Base64( SHA256( UTF-8-Encoding-Of(*SecretKey + ":" + StringToSign*) ) ) For example: For a request to `/project-create` with parameters: apik=yBnXUjjiXSXZ, country\_id=1, loi=10, project\_id=2025, project\_name=Test Survey, project\_type\_id=1, project\_url=<https://google.com/%transid%/>, and request\_date=1442254164458, the *StringToSign* would be:

```
apik=yBnXUjjiXSXZ:country_id=1:loi=10:project_id=2025:project_name=Test Survey:project_type_id=1:project_url=https://google.com/%transid%/:request_date=1442254164458
```

The signature is generated as:

```
Base64( SHA256( UTF-8-Encoding-Of(SecretKey + ":" + StringToSign) ) )
```

Note: Since the SHA256 output is Base64-encoded and may contain URL-unsafe characters, the following replacements must be applied before sending:

| **Character** | **Replacement** |
| ------------- | --------------- |
| +             | -               |
| /             | \_              |
| =             | EMPTY STRING    |

In Java:

```

static String getProdegeMRSignature(String stringToSign, String secretKey)
{
    byte[] utf8Bytes = (secretKey + ":" + stringToSign).getBytes("UTF-8");
    MessageDigest digest = MessageDigest.getInstance("SHA-256");
    byte[] hash = digest.digest(utf8Bytes);
    byte[] base64Hash = Base64.encodeBase64(hash);
    String signature = new String(base64Hash).replace("+", "-")
                                             .replace("/", "_")
                                             .replace("=", "");
    return signature;
}
```

In C#:

```

static string GetProdegeMRSignature(string stringToSign, string secretKey)
{
    var bytes = Encoding.UTF8.GetBytes(secretKey + ":" + stringToSign);
    var algo = new SHA256Managed();
    var hashBytes = algo.ComputeHash(bytes);
    var base64String = System.Convert.ToBase64String(hashBytes);
    var result = base64String.Replace("+", "-")
                             .Replace("/", "_")
                             .Replace("=", "");
    return result;
}
```

In PHP:

```

function getProdegeMRSignature($stringToSign, $secretKey)
{
    $utf8_encoded   = utf8_encode($secretKey . ":" . $stringToSign);
    $sha256_hash    = hash('sha256', $utf8_encoded, true);
    $base64_encoded = base64_encode($sha256_hash);
    $signature      = str_replace("+", "-",
                          str_replace("/", "_",
                          str_replace("=", "", $base64_encoded)));
    return $signature;
}
```

In Python:

```

from hashlib import sha256
from base64 import b64encode

def get_prodegemr_signature(string_to_sign: str, secret_key: str) -> str:
    utf8_encoded = f"{secret_key}:{string_to_sign}".encode("UTF-8")
    hashed = sha256(utf8_encoded).digest()
    base64_encoded = b64encode(hashed).decode("UTF-8")
    return base64_encoded.replace("+", "-").replace("/", "_").replace("=", "")
```