Timestamp

Generate and validate secure UNIX timestamps for every KwikPaisa API request to ensure request authenticity, improve transaction security, and protect APIs against replay attacks, unauthorized request

KwikPaisa APIs require a valid UNIX timestamp in every API request to ensure secure communication and protect APIs against replay attacks and unauthorized request reuse.

The timestamp must be sent in the X-TIMESTAMP header for every authenticated API request.

---

What is X-TIMESTAMP?

X-TIMESTAMP represents the current UNIX timestamp in seconds.

KwikPaisa uses this timestamp to:

• Validate request freshness
• Prevent replay attacks
• Verify request authenticity
• Improve API security

---

Example Header

X-TIMESTAMP: 1778659835

Generate Timestamp

The timestamp should always be generated dynamically before sending an API request.

JavaScript

const timestamp = Math.floor(Date.now() / 1000);
console.log(timestamp);

PHP

<?php
$timestamp = time();
echo $timestamp;

Python

import time
timestamp = int(time.time())
print(timestamp)

Node.js

const timestamp = Math.floor(Date.now() / 1000);
console.log(timestamp);

Java

long timestamp = System.currentTimeMillis() / 1000;
System.out.println(timestamp);

Go

package main
import (
	"fmt"
	"time"
)
func main() {
	timestamp := time.Now().Unix()
	fmt.Println(timestamp)
}

.NET (C#)

using System;
class Program
{
    static void Main()
    {
        long timestamp = DateTimeOffset
            .UtcNow
            .ToUnixTimeSeconds();
        Console.WriteLine(timestamp);
    }
}

Flutter / Dart

int timestamp = DateTime.now()
    .millisecondsSinceEpoch ~/ 1000;
print(timestamp);

Important Notes

• Timestamp must always be generated in UNIX seconds format
• Generate a fresh timestamp for every API request
• Expired timestamps may be rejected
• Server and client system time should remain synchronized
• Reusing old timestamps may invalidate requests

---

Replay Attack Protection

KwikPaisa validates timestamps to protect APIs against replay attacks.

Replay attacks occur when previously valid API requests are reused maliciously.

Using dynamic timestamps helps:

• Prevent duplicate request execution
• Improve request security
• Validate request freshness

---

Example API Request

curl 
--request 
POST \
--url 
https://sandbox.kwikpaisa.com/api/v3/pg/order/create \
--header "Content-Type: application/json" \
--header "Accept: application/json" \
--header "X-API-KEY: pk_test_xxxxxxxxx" \
--header "X-SIGNATURE: GENERATED_SIGNATURE" \
--header "X-TIMESTAMP: 1778659835" \
--data '{}'

---

Common Errors

401 Unauthorized

Possible reasons:

• Expired timestamp
• Invalid timestamp format
• Timestamp mismatch
• Missing X-TIMESTAMP header

---

Best Practices

• Always generate timestamps server-side
• Synchronize server time using NTP
• Never hardcode timestamps
• Generate timestamps immediately before requests
• Validate timestamps while processing webhooks