Client identifier.

HMAC-SHA256 signature, computed client-side before sending and validated server-side (auto-generated by the caller, not a value you choose). Algorithm: remove any existing secureHash, sort the remaining top-level keys alphabetically, join String(value).trim() per key with |, then HMAC-SHA256 the resulting string with your client_secret, hex-encoded. A second variant used by some endpoints strips comments from the raw body first and JSON-stringifies object values instead of String()-converting them — confirm which variant applies with the JPSL integration team before implementing.

1 for seamless/API-driven flow, 0 for redirect flow.