Encryption

All API requests must be sent in encrypted format. TouchPay APIs enforce AES-256-CBC encryption for every request payload to ensure data confidentiality and integrity during transmission. Plain (unencrypted) request bodies will be rejected by the system.

Key Points:

• The output format of encryption is always: Base64( IV + CipherText ).
• All request bodies must be encrypted before sending to the API.
• Encryption uses:
  • AES-256 in CBC mode
  • PBKDF2WithHmacSHA256 for key derivation
  • 16-byte IV
  • 65536 iterations
  • 32-byte key
• The encrypted payload should replace the original JSON request body.
• Decryption is handled automatically on the TouchPay server side.

Reference Implementations:

Encryption logic is provided in multiple programming languages. Use these reference implementations to ensure full encryption compatibility with TouchPay services.

1. Java Implementation (Reference Code):

public class Encryptor {

private static final int KEY_LENGTH = 256;
private static final int ITERATION_COUNT = 65536
public static String encrypt(String strToEncrypt, String appId, String secretKey) {
    try {
        // Generate random IV
        SecureRandom secureRandom = new SecureRandom();
        byte[] iv = new byte[16];
        secureRandom.nextBytes(iv);
        IvParameterSpec ivSpec = new IvParameterSpec(iv)
        // Generate AES key using PBKDF2
        SecretKeyFactory factory = SecretKeyFactory.getInstance("PBKDF2WithHmacSHA256");
        KeySpec spec = new PBEKeySpec(
                appId.toCharArray(),
                secretKey.getBytes(),
                ITERATION_COUNT,
                KEY_LENGTH
        )
        SecretKey tmp = factory.generateSecret(spec);
        SecretKeySpec secretKeySpec = new SecretKeySpec(tmp.getEncoded(), "AES")
        // Initialize cipher
        Cipher cipher = Cipher.getInstance("AES/CBC/PKCS5Padding");
        cipher.init(Cipher.ENCRYPT_MODE, secretKeySpec, ivSpec)
        // Encrypt data
        byte[] cipherText = cipher.doFinal(strToEncrypt.getBytes("UTF-8"))
        // Combine IV and ciphertext
        byte[] encryptedData = new byte[iv.length + cipherText.length];
        System.arraycopy(iv, 0, encryptedData, 0, iv.length);
        System.arraycopy(cipherText, 0, encryptedData, iv.length, cipherText.length)
        // Return Base64 encoded string
        return Base64.getEncoder().encodeToString(encryptedData)
    } catch (Exception e) {
        log.error("Encryptor encrypt error -> {}", e.getMessage());
        return null;
    }
}
}

2. PHP Implementation (Reference Code):

function deriveKey(string $appId, string $secretKey): string
{
    return hash_pbkdf2(
        'sha256',
        $appId,
        $secretKey,
        65536,
        32,
        true
    );
}

function encryptData(string $plaintext, string $appId, string $secretKey): string
{
    // Derive AES-256 key using PBKDF2
    $key = deriveKey($appId, $secretKey);

    // Generate random IV
    $iv = random_bytes(16);

    // Encrypt data using AES-256-CBC
    $ciphertext = openssl_encrypt(
        $plaintext,
        'AES-256-CBC',
        $key,
        OPENSSL_RAW_DATA,
        $iv
    );

    // Return Base64 encoded IV + ciphertext
    return base64_encode($iv . $ciphertext);
}
              

3. NodeJs. Implementation (Reference Code):

const crypto = require('crypto');

function deriveKey(appId, secretKey) {
    return crypto.pbkdf2Sync(
        appId,
        secretKey,
        65536,
        32,
        'sha256'
    );
}

function encrypt(text, appId, secretKey) {
    // Derive AES-256 key using PBKDF2
    const key = deriveKey(appId, secretKey);

    // Generate random IV
    const iv = crypto.randomBytes(16);

    // Create AES-256-CBC cipher
    const cipher = crypto.createCipheriv('aes-256-cbc', key, iv);

    // Encrypt data
    const encrypted = Buffer.concat([
        iv,
        cipher.update(text, 'utf8'),
        cipher.final()
    ]);

    // Return Base64 encoded IV + ciphertext
    return encrypted.toString('base64');
}

4. C#(.NET) Implementation (Reference Code):

using System;
using System.Security.Cryptography;
using System.Text;

public class Encryptor
{
    private const int Iterations = 65536;
    private const int KeyLength = 32; // 256 bits

    private static byte[] DeriveKey(string appId, string secretKey)
    {
        using var deriveBytes = new Rfc2898DeriveBytes(
            appId,
            Encoding.UTF8.GetBytes(secretKey),
            Iterations,
            HashAlgorithmName.SHA256
        );

        return deriveBytes.GetBytes(KeyLength);
    }

    public static string Encrypt(string plainText, string appId, string secretKey)
    {
        // Derive AES-256 key using PBKDF2
        var key = DeriveKey(appId, secretKey);

        // Generate random IV
        var iv = RandomNumberGenerator.GetBytes(16);

        using var aes = Aes.Create();
        aes.Key = key;
        aes.IV = iv;
        aes.Mode = CipherMode.CBC;
        aes.Padding = PaddingMode.PKCS7;

        using var encryptor = aes.CreateEncryptor();
        byte[] cipherText = encryptor.TransformFinalBlock(
            Encoding.UTF8.GetBytes(plainText),
            0,
            plainText.Length
        );

        // Combine IV and ciphertext
        byte[] result = new byte[iv.Length + cipherText.Length];
        Buffer.BlockCopy(iv, 0, result, 0, iv.Length);
        Buffer.BlockCopy(cipherText, 0, result, iv.Length, cipherText.Length);

        // Return Base64 encoded IV + ciphertext
        return Convert.ToBase64String(result);
    }
}
              

5. Python Implementation (Reference Code):

import base64
import os
import hashlib
from Crypto.Cipher import AES
from Crypto.Util.Padding import pad

ITERATIONS = 65536
KEY_LENGTH = 32  # 256 bits


def derive_key(app_id: str, secret_key: str) -> bytes:
    return hashlib.pbkdf2_hmac(
        'sha256',
        app_id.encode(),
        secret_key.encode(),
        ITERATIONS,
        KEY_LENGTH
    )


def encrypt(plaintext: str, app_id: str, secret_key: str) -> str:
    # Derive AES-256 key using PBKDF2
    key = derive_key(app_id, secret_key)

    # Generate random IV
    iv = os.urandom(16)

    # Encrypt using AES-256-CBC
    cipher = AES.new(key, AES.MODE_CBC, iv)
    ciphertext = cipher.encrypt(
        pad(plaintext.encode(), AES.block_size)
    )

    # Combine IV and ciphertext
    encrypted_data = iv + ciphertext

    # Return Base64 encoded IV + ciphertext
    return base64.b64encode(encrypted_data).decode()
              

Payin Methods

TouchPay supports multiple payment methods that allow users to complete transactions seamlessly through cards, net banking, or UPI. Each payin method is securely processed and instantly verified through our APIs.

Payout Methods

TouchPay supports fast and reliable payout options to transfer funds directly to beneficiaries via UPI or Bank Account (Account Number & IFSC). Choose the method that best fits your business workflow for instant or same-day settlements.