Stored in this browser only — never sent to Payonclick. The samples below fill in as you type.
API_KEY="poc_live_your_key_here"
TS=$(date +%s)
BODY='{ "client_reference": "KYC-2026-000123", "pan": "<pan>" }'
HASH=$(printf %s "$BODY" | openssl dgst -sha256 | awk '{print $NF}')
SIG=$(printf '%s\n%s\n%s\n%s' 'POST' '/ext/v1/verify/pan-to-gstin' "$TS" "$HASH" \
| openssl dgst -sha256 -hmac "$API_KEY" | awk '{print $NF}')
curl -X POST 'https://payonclick.in/ext/v1/verify/pan-to-gstin' \
-H "Authorization: Bearer $API_KEY" \
-H "X-Timestamp: $TS" \
-H "X-Signature: $SIG" \
-H 'Content-Type: application/json' \
-d "$BODY"
import hashlib, hmac, json, time, requests
API_KEY = "poc_live_your_key_here"
PATH = "/ext/v1/verify/pan-to-gstin"
BODY = json.dumps({
"client_reference": "KYC-2026-000123",
"pan": "<pan>"
}).encode()
ts = str(int(time.time()))
msg = f"POST\n{PATH}\n{ts}\n{hashlib.sha256(BODY).hexdigest()}"
sig = hmac.new(API_KEY.encode(), msg.encode(), hashlib.sha256).hexdigest()
r = requests.request(
"POST", "https://payonclick.in" + PATH, data=BODY,
headers={
"Authorization": f"Bearer {API_KEY}",
"X-Timestamp": ts,
"X-Signature": sig,
"Content-Type": "application/json",
}, timeout=60)
print(r.json())
const crypto = require('crypto');
const API_KEY = 'poc_live_your_key_here';
const path = '/ext/v1/verify/pan-to-gstin';
const body = JSON.stringify({ "client_reference": "KYC-2026-000123", "pan": "<pan>" });
const ts = Math.floor(Date.now() / 1000).toString();
const hash = crypto.createHash('sha256').update(body).digest('hex');
const msg = `POST\n${path}\n${ts}\n${hash}`;
const sig = crypto.createHmac('sha256', API_KEY).update(msg).digest('hex');
const res = await fetch('https://payonclick.in' + path, {
method: 'POST',
headers: {
Authorization: `Bearer ${API_KEY}`,
'X-Timestamp': ts,
'X-Signature': sig,
'Content-Type': 'application/json',
},
body,
});
console.log(await res.json());
<?php
$apiKey = 'poc_live_your_key_here';
$path = '/ext/v1/verify/pan-to-gstin';
$body = '{ "client_reference": "KYC-2026-000123", "pan": "<pan>" }';
$ts = (string) time();
$msg = "POST\n{$path}\n{$ts}\n" . hash('sha256', $body);
$sig = hash_hmac('sha256', $msg, $apiKey);
$headers = [
"Authorization: Bearer {$apiKey}",
"X-Timestamp: {$ts}",
"X-Signature: {$sig}",
'Content-Type: application/json',
];
$ch = curl_init('https://payonclick.in' . $path);
curl_setopt_array($ch, [
CURLOPT_RETURNTRANSFER => true,
CURLOPT_CUSTOMREQUEST => 'POST',
CURLOPT_POSTFIELDS => $body,
CURLOPT_HTTPHEADER => $headers,
]);
echo curl_exec($ch);
import java.net.URI;
import java.net.http.*;
import java.nio.charset.StandardCharsets;
import java.security.MessageDigest;
import javax.crypto.Mac;
import javax.crypto.spec.SecretKeySpec;
public class PayonclickExample {
static final String HOST = "https://payonclick.in";
static final String API_KEY = "poc_live_your_key_here";
public static void main(String[] args) throws Exception {
String path = "/ext/v1/verify/pan-to-gstin";
String body = "{ \"client_reference\": \"KYC-2026-000123\", \"pan\": \"<pan>\" }";
String ts = String.valueOf(System.currentTimeMillis() / 1000);
HttpRequest.Builder req = HttpRequest.newBuilder(URI.create(HOST + path))
.header("Authorization", "Bearer " + API_KEY)
.header("X-Timestamp", ts);
String hash = hex(MessageDigest.getInstance("SHA-256")
.digest(body.getBytes(StandardCharsets.UTF_8)));
String msg = "POST\n" + path + "\n" + ts + "\n" + hash;
Mac mac = Mac.getInstance("HmacSHA256");
mac.init(new SecretKeySpec(
API_KEY.getBytes(StandardCharsets.UTF_8), "HmacSHA256"));
req.header("X-Signature",
hex(mac.doFinal(msg.getBytes(StandardCharsets.UTF_8))));
req.header("Content-Type", "application/json")
.method("POST", HttpRequest.BodyPublishers.ofString(
body, StandardCharsets.UTF_8));
HttpResponse<String> res = HttpClient.newHttpClient()
.send(req.build(), HttpResponse.BodyHandlers.ofString());
System.out.println(res.body());
}
static String hex(byte[] bytes) {
StringBuilder sb = new StringBuilder();
for (byte b : bytes) sb.append(String.format("%02x", b));
return sb.toString();
}
}
