Why URL Signing is Mandatory for Your Onramper Integration

Overview

To enhance the security, integrity, and reliability of transactions through Onramper, URL signing has been mandatory for all integrations since April 2025. It ensures every API request is authenticated and protected against unauthorized access or tampering. Without it, users encounter an "Invalid Signature" error when attempting to proceed to the buy or sell stage.

We have since upgraded signing to Signature V2 (see below), which all integrations must adopt by October 31st, 2026.

What is URL Signing?

URL signing is a security mechanism that verifies the authenticity of each API request. Using cryptographic signatures, it ensures:

• Requests originate from trusted sources
• Request parameters remain unmodified
• Transactions are protected against tampering and replay attacks

Each request carries a unique cryptographic signature generated with a key known only to you and Onramper. Onramper verifies the signature before processing the request.

Signature V1 vs. Signature V2

There are two versions of URL signing:

• Signature V1 — the original HMAC-based signing introduced in April 2025.
• Signature V2 — the current standard, using Ed25519 signing and adding end-user IP validation. V2 is now required by a growing number of providers to meet their compliance requirements, and must be adopted by all integrations by October 31st, 2026.

Signature V2 introduces an endUserIpHash field — a hash of the end user's IP address, computed on your side and included as a signed field — which satisfies providers' end-user IP validation requirements. (For custom API/checkout integrations, Checkout V2 also adds a platform field.)

You can run V1 and V2 side by side during migration — enabling V2 does not disable V1 — so you can test V2 without disrupting live traffic, then switch over once you're ready.

Why is URL Signing Required?

1. Prevent Unauthorized Access — ensures only authorized parties can send valid requests, reducing the risk of fraudulent activity.
2. Prevent Data Tampering — signed requests guarantee parameters cannot be modified in transit.
3. Enhance Security and Compliance — aligns with industry best practices for securing financial transactions and protecting user data. Signature V2 additionally supports provider-mandated end-user IP validation, keeping your integration compliant as requirements evolve.
4. Ensure Reliable API Interactions — invalid or missing signatures are rejected, preventing unauthorized transactions.

What Happens if URL Signing is Not Implemented?

• Without any URL signing: requests return an "Invalid Signature" error and users cannot complete buy or sell transactions until valid signatures are added.
• After October 31st, 2026: integrations still on Signature V1 will be unable to transact through providers that require end-user IP validation until they migrate to Signature V2.

How to Implement URL Signing

Refer to the technical documentation:

• Widget URL signing (V2): https://docs.onramper.com/docs/widget-sign-a-url-v2
• API request signing (V2): https://docs.onramper.com/docs/api-sign-requests-v2
• Custom checkout (Checkout V2): https://docs.onramper.com/docs/checkout-v2
• Registering your key & onboarding: https://docs.onramper.com/docs/get-set-up-keys-onboarding

Need Assistance?

For questions or implementation support, contact support@onramper.com.

By implementing URL signing — and migrating to Signature V2 — you help keep transactions secure and your integration reliable. Thank you for helping us maintain a safer ecosystem.