Site security

currencyiso3a = GBP
mainamount = 100.00
sitereference = test_site12345
sitesecuritytimestamp = 2019-05-28 14:22:37
password = PASSWORD

Using this example, we would have the following string generated:

GBP100.00test_site123452019-05-28 14:22:37PASSWORD

(Any blank fields are omitted from the hash)

As accurately as possible, this timestamp should reflect the time the customer starts their payment session. (This timestamp value must NOT be in the future)

The value submitted in this field must be in the format YYYY-MM-DD hh:mm:ss.

The timestamp must be in the UTC time zone. (e.g. “2019-05-28 14:22:37”)

The customer has 3 hours from the time specified to complete the transaction, otherwise we will reject the request.

When generating the hash, the fields must be in the same order as listed above. If the fields are not in the correct order, the request will fail.

The order in which fields are hashed can be changed if required. Please contact the Support team for assistance.

The sitesecuritytimestamp and password fields must always be the last two fields in the string used to generate the hash. They cannot be re-positioned among the other fields or removed entirely.

If a field included in the hash has multiple values, these values are concatenated in the order submitted in the POST.

Consider the following additional fields:
ruleidentifier=STR-7&ruleidentifier=STR-6

When included in the string generated above, it becomes:
GBP100.00test_site12345STR-7STR-62019-05-28 14:22:37PASSWORD

Example string:

GBP100.00test_site123452019-05-28 14:22:37PASSWORD

Hashing using SHA-256 will leave us with the following hash:

d08761660c77014d2a41d7dee54c2160863e2e560388601b71bae059d7f456ca

You can use the following code examples as a reference when generating your hash:

#!/usr/bin/python

import hashlib
stringToHash= "GBP100.00test_site123452019-05-28 14:22:37PASSWORD"
print hashlib.sha256(stringToHash).hexdigest()

<?php
echo hash("sha256", "GBP100.00test_site123452019-05-28 14:22:37PASSWORD");
?>

import java.math.BigInteger;
import java.security.MessageDigest;
public class mysha256 {
    public static void main(String args[]) throws Exception {
	String stringToHash = "GBP100.00test_site123452019-05-28 14:22:37PASSWORD";
	MessageDigest digestObj = MessageDigest.getInstance("SHA-256");
	digestObj.update(stringToHash.getBytes("UTF-8"));
	String merchantHash = String.format("%064x",new BigInteger(1,digestObj.digest()));
	System.out.println(merchantHash);
    }
}

#!/usr/bin/perl

use Digest::SHA qw(sha256_hex);
$stringToHash = "GBP100.00test_site123452019-05-28 14:22:37PASSWORD";
$merchantHash = sha256_hex($stringToHash);
print $merchantHash;

Failure to do so could invalidate the hash and stop legitimate transactions.

hd08761660c77014d2a41d7dee54c2160863e2e560388601b71bae059d7f456ca

This is the final value that would need to be submitted in the sitesecurity field for this transaction.

This is to ensure the latest version of the site security feature is used.

Failure to do so could invalidate the hash and stop legitimate transactions.