# Setup Client Key and Signature

Configure your Client ID and RSA key pair, then authenticate and sign your requests.

## 1. Retrieve your Client Key

1. Open **Configuration → API Credentials**.
2. Find **Client ID** under **Private Credentials**.
3. Use this value as the `X-CLIENT-KEY` header.

![Client ID in Private Credentials](/assets/snap-disbursement/client-key.png)

## Generate your key pair

Before registering your public key, generate a 2048-bit RSA private key and export its corresponding public key.

**OpenSSL · Generate private key**

```bash
openssl genrsa -traditional -out rsa_private_key.pem 2048
```

**OpenSSL · Export public key**

```bash
openssl rsa -in rsa_private_key.pem -pubout -out rsa_public_key.pem
```

**Keep your private key secure** The private key stays on your own system. Do not upload it to the Dashboard or share it.

## 2. Register your public key

1. Open **Configuration** in the Brick Dashboard.
2. Select the **Callback URL** tab.
3. Find **Upload Your Public Key**.
4. Paste the contents of `rsa_public_key.pem`, including the `BEGIN PUBLIC KEY` and `END PUBLIC KEY` lines.
5. Select **Save Changes**.

![Upload Your Public Key in Configuration](/assets/snap-disbursement/public-key.png)

If you need to replace an existing public key or cannot save it, contact Brick.

## Sign an authentication request

Use the following signing input:

**Signing input**

```text
83ac6712-5b8f-4b0d-9e24-63aa79102d45|2026-10-20T09:00:00+07:00
```

Sign it with your RSA private key using SHA-256 and PKCS#1 v1.5 padding. Base64-encode the signature and send it as `X-SIGNATURE`. The Client ID and timestamp must match your request headers.

## Request an access token

`POST /v3/payments/sc/snap/access-token`

**Request · cURL**

```bash
curl --request POST \
  --url '{{base_url}}/v3/payments/sc/snap/access-token' \
  --header 'Content-Type: application/json' \
  --header 'X-CLIENT-KEY: 83ac6712-5b8f-4b0d-9e24-63aa79102d45' \
  --header 'X-TIMESTAMP: 2026-10-20T09:00:00+07:00' \
  --header 'X-SIGNATURE: U05BUC1ET0NTLUVYQU1QTEUtU0lHTkFUVVJFLU5PVC1GT1ItQVVUSA==' \
  --data-raw '{
  "grant_type": "client_credentials"
}'
```

**Response · HTTP 200**

```json
{
  "responseCode": "2007300",
  "responseMessage": "Successful",
  "accessToken": "snap_demo_20261020_83ac67125b8f",
  "tokenType": "Bearer",
  "expiresIn": "900"
}
```

## SNAP access tokens

- Each successful token creation request returns a **new access token**.
- A maximum of **5 active, non-expired tokens** is allowed.
- When 5 tokens are active, additional creation requests return **HTTP 429**. Create another token only after at least one existing token expires.
- Each token is valid for **900 seconds (15 minutes)** and can be reused until it expires.
- Generate a signature for every API request according to the SNAP signing requirements. Reusing a token does not remove the signature requirement.

**Reuse your token** Reuse a valid access token across requests instead of creating a new token for every transaction.

Credential, token, and signature values shown in examples are fictional and cannot authenticate a request.

## Sign transfer and status requests

1. Compact the JSON request body by removing insignificant whitespace outside strings.
2. Calculate its SHA-256 hash and represent the result as lowercase hexadecimal.
3. Construct the signing input below.
4. Sign using RSA-SHA256 with PKCS#1 v1.5 padding, then Base64-encode the signature.

**Signing input**

```text
POST:<signed_path>:<body_hash>:2026-10-20T09:00:00+07:00
```

| API | Signing path |
| --- | --- |
| SNAP BI-FAST | `/snap/bifast-transfer` |
| SNAP Regular | `/snap/regular-transfer` |
| Check Status | `/snap/status` |

Preserve the JSON field order, number representation, and string escaping used to calculate the hash. Do not change the body or timestamp after signing. Use an ISO 8601 timestamp with a timezone; synchronize your clock and use a fresh timestamp for each request.

**Request signing** This section authenticates requests sent to Brick. It does not describe callback signature verification.

## Required request headers

| Header | Required | Description |
| --- | --- | --- |
| `Content-Type` | Yes | `application/json` |
| `Authorization` | Yes | Bearer followed by your SNAP access token. |
| `X-CLIENT-KEY` | Yes | Client ID from Configuration → API Credentials. |
| `X-TIMESTAMP` | Yes | ISO 8601 timestamp with a timezone. |
| `X-SIGNATURE` | Yes | Request signature using `/snap/status`. |
| `X-REFERENCE-ID` | Yes | A new UUID identifying this request. |