signature

Payment Signature

Signatures are HMAC-SHA1s of payment data, generated using your "merchant secret key" as the cryptographic key. In the payment flow, there are 2 signatures: the one you generate and send to CitrusPay as part of the "make payment" request to start the payment flow (the request signature), the one CitrusPay generates and send to you as part of the response to your "return URL" at the end of the payment flow (the response signature).

Request signature

This is the HMAC-SHA1 of the string

merchantAccessKey=<access_key>&transactionId=<order_id>&amount=<order_amount>

where:

• <access_key> is your "merchant access key"
• <order_id> is your order (or transaction) identifier
• <order_amount> is the numeric value of the amount of your order (or transaction)

Response signature

This is the HMAC-SHA1 of the string

<TxId><TxStatus><amount><pgTxnNo><issuerRefNo><authIdCode><firstName><lastName><pgRespCode><addressZip>

where <param> is the value of the parameter named param in the response posted by CitrusPay to your "return URL".