admin_signature_post

curl --request POST \
  --url https://checkout.dintero.com/v1/admin/signature \
  --header 'x-api-key: <api-key>'

const options = {method: 'POST', headers: {'x-api-key': '<api-key>'}};

fetch('https://checkout.dintero.com/v1/admin/signature', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

package main

import (
	"fmt"
	"net/http"
	"io"
)

func main() {

	url := "https://checkout.dintero.com/v1/admin/signature"

	req, _ := http.NewRequest("POST", url, nil)

	req.Header.Add("x-api-key", "<api-key>")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

{
  "id": "<string>",
  "created_at": "2023-11-07T05:31:56Z",
  "created_by": "<string>",
  "signature": {
    "type": "v0-hmac-sha256",
    "secret": "<string>"
  }
}

{
  "error": {
    "message": "<string>",
    "code": "<string>",
    "errors": [
      {}
    ]
  }
}

{
  "error": {
    "message": "<string>",
    "code": "<string>",
    "errors": [
      {}
    ]
  }
}

{
  "error": {
    "message": "<string>",
    "code": "<string>",
    "errors": [
      {}
    ]
  }
}

{
  "error": {
    "message": "<string>",
    "code": "<string>",
    "errors": [
      {}
    ]
  }
}

secrets

Create signature secret

Dintero can optionally sign all request it sends to your endpoints.

We do so by including a signature in the request Dintero-Signature header. This allows you to verify that the request was done by Dintero, not by a third party.

v0-hmac-sha256

<timestamp>\n<account_id>\n<method>\n<hostname>\n<pathname>\n<query>

secret: 123
timestamp: 1582236537
account_id: P00000000
method: GET
url: https://example.com/callback?B=123&A=992

Dintero-Signature: t=1582236537,
    v0-hmac-sha256=6bed2ab1b919d460ef7465a20dc6c97260dca73fab6647106ca525f0908df64a

The timestamp (t) in the Dintero-Signature, is included in the signature payload to mitigate replay attach. If your signature is valid but the timestamp is too old, you can have your application reject the request. We recommend that your application have a tolerance of five minutes between the timestamp and the current time.

NOTE: The query parameters must be sorted.

scopes:

admin:checkout
write:checkout

POST

https://checkout.dintero.com/v1

admin

signature

admin_signature_post

curl --request POST \
  --url https://checkout.dintero.com/v1/admin/signature \
  --header 'x-api-key: <api-key>'

const options = {method: 'POST', headers: {'x-api-key': '<api-key>'}};

fetch('https://checkout.dintero.com/v1/admin/signature', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

package main

import (
	"fmt"
	"net/http"
	"io"
)

func main() {

	url := "https://checkout.dintero.com/v1/admin/signature"

	req, _ := http.NewRequest("POST", url, nil)

	req.Header.Add("x-api-key", "<api-key>")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

{
  "id": "<string>",
  "created_at": "2023-11-07T05:31:56Z",
  "created_by": "<string>",
  "signature": {
    "type": "v0-hmac-sha256",
    "secret": "<string>"
  }
}

{
  "error": {
    "message": "<string>",
    "code": "<string>",
    "errors": [
      {}
    ]
  }
}

{
  "error": {
    "message": "<string>",
    "code": "<string>",
    "errors": [
      {}
    ]
  }
}

{
  "error": {
    "message": "<string>",
    "code": "<string>",
    "errors": [
      {}
    ]
  }
}

{
  "error": {
    "message": "<string>",
    "code": "<string>",
    "errors": [
      {}
    ]
  }
}

Authorizations

x-api-key

string

header

required

X-API-Key authentication for accessing admin endpoints. Use Create api-key to create a key.

The content of the header should look like the following:

x-api-key: {api_key}

Response

signature secret

string

An ID that uniquely identifies the resource

created_at

string<date-time>

The date-time when the resource was created

created_by

string

signature

object

Secret used when creating Dintero-Signature header of server-to-serer callbacks

Show child attributes

Last modified on July 14, 2026

Get signature secret

Get payment logos image

⌘I