TIME=$(date +%s)
BODY="{\"merchant_id\":\"AA12345678\",\"token\":\"YOUR_TOKEN\",\"time\":$TIME,\"merchant_order_id\":\"PAYOUT-2026-001\",\"amount\":\"1000.00\",\"bank\":\"KBANK\",\"account_name\":\"ลูกค้า ปลายทาง\",\"account_no\":\"1234567890\",\"notify_url\":\"https://<your-merchant-webhook-URL>/withdraw-callback\"}"
SIG=$(printf '%s' "$BODY" | openssl dgst -sha256 -hmac "YOUR_SECRET" | awk '{print $2}')

curl -X POST https://<your-api-domain>/withdraw/create \
  -H "Content-Type: application/json" \
  -H "X-SIGNATURE: $SIG" \
  -d "$BODY"

import crypto from 'node:crypto';

const SECRET = 'YOUR_SECRET';
const body = JSON.stringify({
  merchant_id:       'AA12345678',
  token:             'YOUR_TOKEN',
  time:             Math.floor(Date.now() / 1000),
  merchant_order_id: 'PAYOUT-2026-001',
  amount:            '1000.00',
  bank:              'KBANK',
  account_name:      'ลูกค้า ปลายทาง',
  account_no:        '1234567890',
  notify_url:        'https://<your-merchant-webhook-URL>/withdraw-callback',
});
const sig = crypto.createHmac('sha256', SECRET).update(body).digest('hex');

const r = await fetch('https://<your-api-domain>/withdraw/create', {
  method:  'POST',
  headers: { 'Content-Type': 'application/json', 'X-SIGNATURE': sig },
  body
});
console.log(await r.json());

<?php
$secret = 'YOUR_SECRET';
$body = json_encode([
    'merchant_id'       => 'AA12345678',
    'token'             => 'YOUR_TOKEN',
    'time'              => time(),
    'merchant_order_id' => 'PAYOUT-2026-001',
    'amount'            => '1000.00',
    'bank'              => 'KBANK',
    'account_name'      => 'ลูกค้า ปลายทาง',
    'account_no'        => '1234567890',
    'notify_url'        => 'https://<your-merchant-webhook-URL>/withdraw-callback',
], JSON_UNESCAPED_UNICODE | JSON_UNESCAPED_SLASHES);

$sig = hash_hmac('sha256', $body, $secret);

$ch = curl_init('https://<your-api-domain>/withdraw/create');
curl_setopt_array($ch, [
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_POST           => true,
    CURLOPT_POSTFIELDS     => $body,
    CURLOPT_HTTPHEADER     => [
        'Content-Type: application/json',
        "X-SIGNATURE: $sig",
    ],
]);
echo curl_exec($ch);