signature

Payment Signature

Signatures are HMAC-SHA1s of payment data, generated using your "merchant secret key" as the cryptographic key. In the payment flow, there are 2 signatures: the one you generate and send to CitrusPay as part of the "make payment" request to start the payment flow (the request signature), the one CitrusPay generates and send to you as part of the response to your "return URL" at the end of the payment flow (the response signature).

Request signature

This is the HMAC-SHA1 of the string

merchantAccessKey=<access_key>&transactionId=<order_id>&amount=<order_amount>

where:

• <access_key> is your "merchant access key"
• <order_id> is your order (or transaction) identifier
• <order_amount> is the numeric value of the amount of your order (or transaction)

Response signature

This is the HMAC-SHA1 of the string

<TxId><TxStatus><amount><pgTxnNo><issuerRefNo><authIdCode><firstName><lastName><pgRespCode><addressZip>

where <param> is the value of the parameter named param in the response posted by CitrusPay to your "return URL".

Implementation

Most modern platforms come with an HMAC-SHA1 implementation. The signature your are passing / receiving is actually the hexadecimal encoding of the HMAC.

As an example, here is a couple of HMAC-SHA1 implementation in different programming languages, for sample "merchant secret key" 647c4c37ce8d84d09c83f836faf97aae722e716a and signing string "foo bar". Expected result being 19157bfd6eb14e50c2522631eb2dd9f978ecdb90...

JavaScript / Node.js

var crypto = require('crypto');
var hmac = crypto.createHmac('sha1', '647c4c37ce8d84d09c83f836faf97aae722e716a');
hmac.update('foo bar');
var signature = hmac.digest('hex');
console.log(signature);