Skip to main content

Key Pairs Required

Two sets of RSA/ECC key pairs are needed before making any API calls.

1. Company Key Pair (RSA)

Used to authenticate all API requests. Generated once per company. Keys must be RSA, base64-encoded, minimum 2048 bits.

2. User Key Pair (ECC)

Each API user (maker and checker) needs an Elliptic Curve key pair using SECP256R1.
Share with Zodia: the user’s email, ECC public key, and assigned roles (Viewer, Maker, Checker).

Request Headers

Zodia’s API authentication requires each request to be signed. These requests must be signed using company_pri_key, the private key of your company. All REST requests must contain the following headers:
  1. company-identifier is the identifier provided to you during the setup of your company on the Zodia Platform. This is usually a uppercase string with no spaces.
  2. submitter-id is the email id of the API user
  3. request-identifier is an unique randomly generated identifier
  4. request-timestamp is the timestamp (milliseconds elapsed since the unix epoch) of when the request is submitted. Please note that the request should be submitted within 5 minutes
  5. signature is the signature generated using company_pri_key (i.e. using the SHA256withRSA algorithm). Please refer to the section for generating signature Signing Requests.
All request bodies should have content type application/json and be valid JSON.

Signature Types

Two distinct signature types are used in the Zodia API: Signature types explained

Onboarding Checklist

  1. Generate company RSA key pair
  2. Send company_pub_key to customerservice@zodia.io
  3. Generate ECC key pairs for at least one maker and one checker user
  4. Send user emails, public keys, and roles to customerservice@zodia.io