Copy page

Setup Client Key and Signature

This SNAP Disbursement guide is currently available in English.

Configure your Client ID and RSA key pair, then authenticate and sign your requests.

1. Retrieve your Client Key

1. Open Configuration → API Credentials.
2. Find Client ID under Private Credentials.
3. Use this value as the X-CLIENT-KEY header.

Generate your key pair

Before registering your public key, generate a 2048-bit RSA private key and export its corresponding public key.

OpenSSL · Generate private key

Code
openssl genrsa -traditional -out rsa_private_key.pem 2048

OpenSSL · Export public key

Code
openssl rsa -in rsa_private_key.pem -pubout -out rsa_public_key.pem

Keep your private key secure The private key stays on your own system. Do not upload it to the Dashboard or share it.

2. Register your public key

1. Open Configuration in the Brick Dashboard.
2. Select the Callback URL tab.
3. Find Upload Your Public Key.
4. Paste the contents of rsa_public_key.pem, including the BEGIN PUBLIC KEY and END PUBLIC KEY lines.
5. Select Save Changes.

If you need to replace an existing public key or cannot save it, contact Brick.

Sign an authentication request

Use the following signing input:

Signing input

Code
83ac6712-5b8f-4b0d-9e24-63aa79102d45|2026-10-20T09:00:00+07:00

Sign it with your RSA private key using SHA-256 and PKCS#1 v1.5 padding. Base64-encode the signature and send it as X-SIGNATURE. The Client ID and timestamp must match your request headers.

Request an access token

POST /v3/payments/sc/snap/access-token

Request · cURL

Code
curl --request POST \
  --url '{{base_url}}/v3/payments/sc/snap/access-token' \
  --header 'Content-Type: application/json' \
  --header 'X-CLIENT-KEY: 83ac6712-5b8f-4b0d-9e24-63aa79102d45' \
  --header 'X-TIMESTAMP: 2026-10-20T09:00:00+07:00' \
  --header 'X-SIGNATURE: U05BUC1ET0NTLUVYQU1QTEUtU0lHTkFUVVJFLU5PVC1GT1ItQVVUSA==' \
  --data-raw '{
  "grant_type": "client_credentials"
}'

Response · HTTP 200

Code
{
  "responseCode": "2007300",
  "responseMessage": "Successful",
  "accessToken": "snap_demo_20261020_83ac67125b8f",
  "tokenType": "Bearer",
  "expiresIn": "900"
}

SNAP access tokens

• Each successful token creation request returns a new access token.
• A maximum of 5 active, non-expired tokens is allowed.
• When 5 tokens are active, additional creation requests return HTTP 429. Create another token only after at least one existing token expires.
• Each token is valid for 900 seconds (15 minutes) and can be reused until it expires.
• Generate a signature for every API request according to the SNAP signing requirements. Reusing a token does not remove the signature requirement.

Reuse your token Reuse a valid access token across requests instead of creating a new token for every transaction.

Credential, token, and signature values shown in examples are fictional and cannot authenticate a request.

Sign transfer and status requests

1. Compact the JSON request body by removing insignificant whitespace outside strings.
2. Calculate its SHA-256 hash and represent the result as lowercase hexadecimal.
3. Construct the signing input below.
4. Sign using RSA-SHA256 with PKCS#1 v1.5 padding, then Base64-encode the signature.

Signing input

Code
POST:<signed_path>:<body_hash>:2026-10-20T09:00:00+07:00

Preserve the JSON field order, number representation, and string escaping used to calculate the hash. Do not change the body or timestamp after signing. Use an ISO 8601 timestamp with a timezone; synchronize your clock and use a fresh timestamp for each request.

Request signing This section authenticates requests sent to Brick. It does not describe callback signature verification.

Required request headers