Monobank Corporate API - Vaadin Client

A web interface built with Vaadin to interact with the Monobank Corporate API.

This application simplifies the complex cryptographic requirements of the Monobank API, specifically the generation of the X-Sign header (ECDSA signature using a secp256k1 key pair), allowing businesses to easily register and check their integration status.

Features & Workflow

The application consists of two main tabs: Registration and Status Check.

1. Registration (/personal/auth/registration)

This section allows a new corporate client to apply for API access.

• What happens under the hood:

  1. The app generates a new secp256k1 cryptographic key pair using the BouncyCastle provider.
  2. It constructs the X-Sign header by signing the concatenation of the current UNIX timestamp (X-Time) and the request path using the generated private key (SHA256withECDSA).
  3. The form data (Company Name, Contact Person, etc.) alongside the Base64-encoded Public Key is sent to the Monobank API.
  4. Upon successful registration, the user is provided with direct download links to safely store their private.key and public.pem files. These keys are not stored on the server.
  

---

2. Status Check (/personal/auth/registration/status)

This section allows an existing applicant to check the approval status of their application.

• What happens under the hood:

  1. The user uploads their previously saved private.key and public.pem files via the drag-and-drop interface.
  2. The application reads these files into memory to re-generate a valid X-Sign header for the /status endpoint.
  3. It sends the signed request to the Monobank API and displays the HTTP status code and the raw JSON response directly in the UI.
  

Tech Stack

• UI Framework: Vaadin Flow (Java)
• Cryptography: Java Security APIs + org.bouncycastle
• HTTP Client: Native Java java.net.http.HttpClient