# Signing Multipart Requests

To sign requests using the `multipart/form-data` content type, use this modified signing algorithm:

1. Construct the following string: `{method}\n{path}\n{headers}\n{bodyDigest}`, where:
   * `{method}` is the HTTP method, in uppercase.

   * `{path}` is the remainder of the URL following the host, including the query string (if present).

   * `{headers}` is the concatenation of the following headers (if present) in the form `{lowercase(name)}:{strip(value)}\n`:

     * `Accept`
     * `Authorization`
     * `Content-Type` (this should be `multipart/form-data` with no other parameters)
     * `Host`

   * `{bodyDigest}` is the lowercased, hexadecimal representation of the SHA256 digest of the bytes of the `request` object specified in the request body.

2. Create an HMAC-SHA256 cryptographic hash where the text to hash is the string you created in step 1, and the secret is the secret value associated with the API key being used to make the request.

3. Append a `text/plain` object named `signature` to the request body, containing the value `V1 {signature}` where `{signature}` is the value obtained in step 2 in hexademical and lowercased.

   > This signature will take precedence over any `X-Signature` header present in the request.

   > Instead of computing a real signature in Sandbox, you can use a [magic value](/cash-app-pay-partner-api/guides/technical-guides/sandbox/developer-sandbox#magic-values): `sandbox:skip-signature-check`