For signed APIs, partners need to use Ed25519 signature-based authentication instead of JWT. Each request must be cryptographically signed using an Ed25519 private key held by the partner.
Holdstation Pay verifies the signature on the server side using the partner’s registered public key. This ensures both the authenticity and integrity of every request, preventing tampering or replay attacks.
Signed API authentication is required in addition to the Partner-App-Key header — all three signed-request headers must be present on every signed request.
Keep your API key secure. Do not expose it in client-side code or public repositories.
Each signed request must include:
The signature is computed over the sign data, which is built by joining the sorted query string, the raw request body, and the timestamp with \n:
See Signing Requests for the full signing algorithm and code examples. 
