Stored in this browser only — never sent to Payonclick. The samples below fill in as you type.
API_KEY="poc_live_your_key_here"
TS=$(date +%s)
BODY='{ "merchant_ref": "OUTLET-1001", "client_reference": "CW-2026-000123", "aadhaar": "987698769870", "bank_iin": "607094", "amount": 2500, "customer_mobile": "9123456789", "auth_mode": "FP", "pid_data": "<PidData>... the XML the RD service returned ...</PidData>", "latitude": 25.5941, "longitude": 85.1376 }'
HASH=$(printf %s "$BODY" | openssl dgst -sha256 | awk '{print $NF}')
SIG=$(printf '%s\n%s\n%s\n%s' 'POST' '/ext/v1/aeps/cash-withdrawal' "$TS" "$HASH" \
| openssl dgst -sha256 -hmac "$API_KEY" | awk '{print $NF}')
curl -X POST 'https://payonclick.in/ext/v1/aeps/cash-withdrawal' \
-H "Authorization: Bearer $API_KEY" \
-H "X-Timestamp: $TS" \
-H "X-Signature: $SIG" \
-H 'Content-Type: application/json' \
-d "$BODY"
import hashlib, hmac, json, time, requests
API_KEY = "poc_live_your_key_here"
PATH = "/ext/v1/aeps/cash-withdrawal"
BODY = json.dumps({
"merchant_ref": "OUTLET-1001",
"client_reference": "CW-2026-000123",
"aadhaar": "987698769870",
"bank_iin": "607094",
"amount": 2500,
"customer_mobile": "9123456789",
"auth_mode": "FP",
"pid_data": "<PidData>... the XML the RD service returned ...</PidData>",
"latitude": 25.5941,
"longitude": 85.1376
}).encode()
ts = str(int(time.time()))
msg = f"POST\n{PATH}\n{ts}\n{hashlib.sha256(BODY).hexdigest()}"
sig = hmac.new(API_KEY.encode(), msg.encode(), hashlib.sha256).hexdigest()
r = requests.request(
"POST", "https://payonclick.in" + PATH + "", data=BODY,
headers={
"Authorization": f"Bearer {API_KEY}",
"X-Timestamp": ts,
"X-Signature": sig,
"Content-Type": "application/json",
}, timeout=90)
print(r.json())
const crypto = require('crypto');
const API_KEY = 'poc_live_your_key_here';
const path = '/ext/v1/aeps/cash-withdrawal';
const body = JSON.stringify({ "merchant_ref": "OUTLET-1001", "client_reference": "CW-2026-000123", "aadhaar": "987698769870", "bank_iin": "607094", "amount": 2500, "customer_mobile": "9123456789", "auth_mode": "FP", "pid_data": "<PidData>... the XML the RD service returned ...</PidData>", "latitude": 25.5941, "longitude": 85.1376 });
const ts = Math.floor(Date.now() / 1000).toString();
const hash = crypto.createHash('sha256').update(body).digest('hex');
const msg = `POST\n${path}\n${ts}\n${hash}`;
const sig = crypto.createHmac('sha256', API_KEY).update(msg).digest('hex');
async function main() {
const res = await fetch('https://payonclick.in' + path + '', {
method: 'POST',
headers: {
Authorization: `Bearer ${API_KEY}`,
'X-Timestamp': ts,
'X-Signature': sig,
'Content-Type': 'application/json',
},
body,
signal: AbortSignal.timeout(90000),
});
console.log(JSON.stringify(await res.json(), null, 2));
}
main();
<?php
$apiKey = 'poc_live_your_key_here';
$path = '/ext/v1/aeps/cash-withdrawal';
$body = '{ "merchant_ref": "OUTLET-1001", "client_reference": "CW-2026-000123", "aadhaar": "987698769870", "bank_iin": "607094", "amount": 2500, "customer_mobile": "9123456789", "auth_mode": "FP", "pid_data": "<PidData>... the XML the RD service returned ...</PidData>", "latitude": 25.5941, "longitude": 85.1376 }';
$ts = (string) time();
$msg = "POST\n{$path}\n{$ts}\n" . hash('sha256', $body);
$sig = hash_hmac('sha256', $msg, $apiKey);
$headers = [
"Authorization: Bearer {$apiKey}",
"X-Timestamp: {$ts}",
"X-Signature: {$sig}",
'Content-Type: application/json',
];
$ch = curl_init('https://payonclick.in' . $path . '');
curl_setopt_array($ch, [
CURLOPT_RETURNTRANSFER => true,
CURLOPT_TIMEOUT => 90,
CURLOPT_CUSTOMREQUEST => 'POST',
CURLOPT_POSTFIELDS => $body,
CURLOPT_HTTPHEADER => $headers,
]);
echo curl_exec($ch);
import java.net.URI;
import java.net.http.*;
import java.nio.charset.StandardCharsets;
import java.security.MessageDigest;
import javax.crypto.Mac;
import javax.crypto.spec.SecretKeySpec;
public class PayonclickExample {
static final String HOST = "https://payonclick.in";
static final String API_KEY = "poc_live_your_key_here";
public static void main(String[] args) throws Exception {
String path = "/ext/v1/aeps/cash-withdrawal";
String body = "{ \"merchant_ref\": \"OUTLET-1001\", \"client_reference\": \"CW-2026-000123\", \"aadhaar\": \"987698769870\", \"bank_iin\": \"607094\", \"amount\": 2500, \"customer_mobile\": \"9123456789\", \"auth_mode\": \"FP\", \"pid_data\": \"<PidData>... the XML the RD service returned ...</PidData>\", \"latitude\": 25.5941, \"longitude\": 85.1376 }";
String ts = String.valueOf(System.currentTimeMillis() / 1000);
HttpRequest.Builder req = HttpRequest.newBuilder(URI.create(HOST + path + ""))
.timeout(java.time.Duration.ofSeconds(90))
.header("Authorization", "Bearer " + API_KEY)
.header("X-Timestamp", ts);
String hash = hex(MessageDigest.getInstance("SHA-256")
.digest(body.getBytes(StandardCharsets.UTF_8)));
String msg = "POST\n" + path + "\n" + ts + "\n" + hash;
Mac mac = Mac.getInstance("HmacSHA256");
mac.init(new SecretKeySpec(
API_KEY.getBytes(StandardCharsets.UTF_8), "HmacSHA256"));
req.header("X-Signature",
hex(mac.doFinal(msg.getBytes(StandardCharsets.UTF_8))));
req.header("Content-Type", "application/json")
.method("POST", HttpRequest.BodyPublishers.ofString(
body, StandardCharsets.UTF_8));
HttpResponse<String> res = HttpClient.newHttpClient()
.send(req.build(), HttpResponse.BodyHandlers.ofString());
System.out.println(res.body());
}
static String hex(byte[] bytes) {
StringBuilder sb = new StringBuilder();
for (byte b : bytes) sb.append(String.format("%02x", b));
return sb.toString();
}
}
