Overview
Our SNAP API offer a set of APIs that provide the ability to integrate with 2C2P securely and compliant.
You can use the POST
method to send HTTPS requests and receive responses accordingly.
Follow the steps to begin to integrate with our SNAP API
Step 1 : Generate your RSA key and exchange keys
- Download the 2C2P Public Key from the 2C2P Merchant Portal: Go to Account > Options > 2C2P Public Keys
- Secure a pair of public and private keys. (For a guide to generating keys, referhere). Please make sure the uploaded public key is inx509 format
- Merchants must then upload the generated public key to the 2C2P Merchant Portal: Log in and go to Account > Options > Merchant Public Keys. Add the public key and set it as default.
Note: Do ensure that the public key uploaded to 2C2P Merchant Portal has the key ID snap
.
Step 2 : Understand Message Structure
HTTPS method
POST
method is being used in 2C2P SNAP API.
Header
The request header mainly contains the following fields
Note: Field names are case-insensitive.
Header Field | Required | Code Sample |
---|---|---|
X-TIMESTAMP | Yes | 2025-08-16T00:00:46+08:00 |
X-CLIENT-KEY | Yes | {YOUR_MERCHANT_ID} |
X-SIGNATURE | Yes | f6Cw095brnBF+mL589uxWUnKDc.....P0Tni4YRbH9tYFH6CvNQ== |
X-PARTNER-ID | Yes | {YOUR_MERCHANT_ID} |
Authorization | Yes | Bearer {Token} |
Content-Type | No | application/json |
For details of each header field, please see the following descriptions:
X-TIMESTAMP
X-TIMESTAMP specifies the timestamp of when the request is sent. Please see the following format of this field
{year}-${month}-${day}T${hours}:${minutes}:${seconds}${+, -}${offsetHours}:${offsetMinutes}
X-CLIENT-KEY
This parameter is only used in OAuth API
X-CLIENT-KEY is used to identify the merchant. This is given to you during merchant onboarding.
X-SIGNATURE
X-SIGNATURE contains the signature value of this request. Please see below for details about how to generate a signature.
The syntax of generating the signature is as follows:
signature=base64Encode(sha256withRSA( {content}, {YOUR_PRIVATE_KEY} ))
- signature: the generated signature string
- base64Encode: the method to encode the generated digital signature.
- sha256withrsa: the method to generate a digital signature for the provided content.
- content : {YOUR_MERCHANT_ID}|{X-TIMESTAMP}
For OAuth, the content to be signed will be {YOUR_MERCHANT_ID}|{X-TIMESTAMP}
For Other API, the content to be signed will be the request body
Sample: 70270200000000|2025-08-16T00:00:46+08:00
- private key : the private key value
The following code sample shows how to generate the signature:
using System;
using System.Security.Cryptography;
using System.Text;
class SignatureSampleCode
{
public static string Sign(string merchantId, string xtimestamp, string merchantPrivateKey)
{
string content = $"{merchantId}|{xtimestamp}";
using RSA rsa = RSA.Create();
rsa.ImportFromPem(merchantPrivateKey);
byte[] dataBytes = Encoding.UTF8.GetBytes(data);
byte[] signedBytes = rsa.SignData(dataBytes, HashAlgorithmName.SHA256, RSASignaturePadding.Pkcs1);
return Convert.ToBase64String(signedBytes);
}
static void Main()
{
string MERCHANT_ID = "";
string MERCHANT_PRIVATE_KEY = "";
Console.WriteLine(Sign(MERCHANT_ID, "2025-08-16T00:00:46+08:00", MERCHANT_PRIVATE_KEY));
}
}
const crypto = require("crypto");
/**
* Signs merchantId|timestamp using SHA256withRSA
* @param {string} merchantId
* @param {string} xtimestamp
* @param {string} merchantPrivateKey your private key
* @returns {string} Base64 signature
*/
function sign(merchantId, xtimestamp, merchantPrivateKey) {
const content = `${merchantId}|${xtimestamp}`;
// Sign data
const signature = crypto.sign("sha256", Buffer.from(data, "utf8"), {
key: privateKeyPem,
padding: crypto.constants.RSA_PKCS1_PADDING
});
// Return Base64 signature
return signature.toString("base64");
}
// Example usage
const MERCHANT_ID = "";
const MERCHANT_PRIVATE_KEY = "";
console.log(sign(MERCHANT_ID, "2025-08-16T00:00:46+08:00", MERCHANT_PRIVATE_KEY));
import java.nio.charset.StandardCharsets;
import java.security.KeyFactory;
import java.security.PrivateKey;
import java.security.spec.PKCS8EncodedKeySpec;
import java.util.Base64;
public class SignatureSampleCode {
/**
* your private key, used to sign
*/
private static final String MERCHANT_PRIVATE_KEY = "";
/**
* you merchantId
*/
private static final String MERCHANT_ID = "";
/**
* @param merchantId your merchantId
* @param xtimestamp timestamp value, sample: 2025-08-16T00:00:46+08:00
* @param merchant_private_key your private key
* @return
*/
public static String sign(String merchantId, String xtimestamp, String merchant_private_key) {
// content_to_be_signed
String content = merchantId + "|" + xtimestamp;
try {
// sha256withRSA
java.security.Signature signature = java.security.Signature.getInstance("SHA256withRSA");
// privateKey
PrivateKey priKey = KeyFactory.getInstance("RSA").generatePrivate(
new PKCS8EncodedKeySpec(Base64.getDecoder().decode(merchant_private_key.getBytes(StandardCharsets.UTF_8))));
signature.initSign(priKey);
signature.update(contentToBeSigned.getBytes(StandardCharsets.UTF_8));
// sign
byte[] signed = signature.sign();
// base64Encode
String base64EncodedSignature = new String(Base64.getEncoder().encode(signed), StandardCharsets.UTF_8);
// urlEncode
return base64EncodedSignature;
} catch (Exception e) {
throw new RuntimeException(e);
}
}
public static void main(String[] args) {
System.out.println(sign( MERCHANT_ID, "2025-08-16T00:00:46+08:00", MERCHANT_PRIVATE_KEY));
}
}
X-PARTNER-ID
This parameter is only used in all APIs except for OAuth. For OAuth request, please use X-CLIENT-KEY
X-PARTNER-ID is used to identify the merchant. This is given to you during merchant onboarding.
Authorization
This header field is only required for subsequent request after calling SNAP OAuth API
It is not required when retrieving access token.
Value: Bearer {access token}
Body
Fields enclosed in the request body section vary depending on services. For more information, see instructions on the specific API specification.
Step 3 : Making your first API call
Environment
Environment | Base URL |
---|---|
Sandbox | https://sandbox-pgw.2c2p.com |
Production | https://pgw.2c2p.com |
For more information on for each API, see instructions on the specific API specification.
Updated 3 minutes ago