Request hashing

// Copy and paste this code into your backend
let crypto = require('crypto');
function generateKashierOrderHash(order) {
  const mid = 'MID-123-123'; // Your merchant ID
  const CustomerReference = ''; // Required when save, cardToken, or agreement is sent
  const amount = order.amount; // e.g., 22.00
  const currency = order.currency; // e.g., "EGP"
  const orderId = order.merchantOrderId; // e.g., 99
  const apiKey = 'yourApiKey';
  const path = `/?payment=${mid}.${orderId}.${amount}.${currency}${CustomerReference ? '.' + CustomerReference : ''}`;
  const hash = crypto.createHmac('sha256', apiKey).update(path).digest('hex');
  return hash;
}
// The result hash for /?payment=mid-0-1.99.20.EGP with key 11111
// should be 606a8a1307d64caf4e2e9bb724738f115a8972c27eccb2a8acd9194c357e4bec

// Copy and paste this code into your backend
function generateKashierOrderHash($order) {
  $mid = "MID-123-123"; // Your merchant ID
  $amount = $order->amount; // e.g., 100
  $currency = $order->currency; // e.g., "EGP"
  $orderId = $order->merchantOrderId; // e.g., 99
  $apiKey = "yourApiKey";
  $CustomerReference = ""; // Required when save, cardToken, or agreement is sent
  $path = "/?payment=".$mid.".".$orderId.".".$amount.".".$currency;
  if (!empty($CustomerReference)) {
      $path .= ".".$CustomerReference;
  }
  return hash_hmac('sha256', $path, $apiKey, false);
}
// The result hash for /?payment=mid-0-1.99.20.EGP with key 11111
// should be 606a8a1307d64caf4e2e9bb724738f115a8972c27eccb2a8acd9194c357e4bec

# Copy and paste this code into your backend
import hmac
import hashlib
def generateKashierOrderHash(order):
  mid = "MID-123-123"  # Your merchant ID
  amount = order['amount']  # e.g., 100
  currency = order['currency']  # e.g., "EGP"
  orderId = order['merchantOrderId']  # e.g., 99
  CustomerReference = ""  # Required when save, cardToken, or agreement is sent
  path = f"/?payment={mid}.{orderId}.{amount}.{currency}"
  if CustomerReference:
      path += f".{CustomerReference}"
  apiKey = "yourApiKey"
  return hmac.new(apiKey.encode('utf-8'), path.encode('utf-8'), hashlib.sha256).hexdigest()
# The result hash for /?payment=mid-0-1.99.20.EGP with secret 11111
# should be 606a8a1307d64caf4e2e9bb724738f115a8972c27eccb2a8acd9194c357e4bec

// Copy and paste this code into your backend
using System;
using System.Security.Cryptography;
public class Kashier
{
  public static string CreateHash()
  {
      string mid = "mid-0-1"; // Merchant ID from the comment example
      string amount = "20"; // Amount from the comment example
      string currency = "EGP";
      string orderId = "99"; // Order ID from the comment example
      string CustomerReference = ""; // Required when save, cardToken, or agreement is sent
      string apiKey = "11111"; // Payment API Key from the comment example
      string path = $"/?payment={mid}.{orderId}.{amount}.{currency}";
      if (!string.IsNullOrEmpty(CustomerReference))
      {
          path += $".{CustomerReference}";
      }
      using (var hmac = new HMACSHA256(System.Text.Encoding.ASCII.GetBytes(apiKey)))
      {
          byte[] hash = hmac.ComputeHash(System.Text.Encoding.ASCII.GetBytes(path));
          return BitConverter.ToString(hash).Replace("-", "").ToLower();
      }
  }
}
// The result hash for /?payment=mid-0-1.99.20.EGP with key 11111
// should be: 606a8a1307d64caf4e2e9bb724738f115a8972c27eccb2a8acd9194c357e4bec

const crypto = require('crypto');

// Copy and paste this code into your backend
function validateSignature(query, secret) {
  const body =
    `paymentStatus=${query.paymentStatus}` +
    `&cardDataToken=${query.cardDataToken}` +
    `&maskedCard=${query.maskedCard}` +
    `&merchantOrderId=${query.merchantOrderId}` +
    `&orderId=${query.orderId}` +
    `&cardBrand=${query.cardBrand}` +
    `&orderReference=${query.orderReference}` +
    `&transactionId=${query.transactionId}` +
    `&amount=${query.amount}` +
    `&currency=${query.currency}`;
  const signature = crypto.createHmac('sha256', secret).update(body).digest('hex');
  return signature === query.signature;
}

<?php
// Copy and paste this code into your backend
$secret = 'your_APIKEY';
$fields = [
  'paymentStatus', 'cardDataToken', 'maskedCard', 'merchantOrderId', 'orderId',
  'cardBrand', 'orderReference', 'transactionId', 'amount', 'currency',
];
$parts = [];
foreach ($fields as $field) {
  $parts[] = $field . '=' . ($_GET[$field] ?? 'null');
}
$body = implode('&', $parts);
$signature = hash_hmac('sha256', $body, $secret, false);
if (hash_equals($signature, $_GET['signature'] ?? '')) {
  echo "Success signature";
} else {
  echo "Failed signature";
}
?>

# Copy and paste this code in your backend
import hmac
import hashlib

FIELDS = [
    "paymentStatus", "cardDataToken", "maskedCard", "merchantOrderId", "orderId",
    "cardBrand", "orderReference", "transactionId", "amount", "currency",
]

def validateSignature(request, secret):
    body = "&".join(f"{field}={request.get(field, 'null')}" for field in FIELDS)
    signature = hmac.new(
        secret.encode("utf-8"), body.encode("utf-8"), hashlib.sha256
    ).hexdigest()
    return "success" if hmac.compare_digest(signature, request.get("signature", "")) else "failure"

using System;
using System.Security.Cryptography;
using System.Text;
using System.Web.Mvc;
public class WebhookController : Controller
{
  private static readonly string[] Fields = {
      "paymentStatus", "cardDataToken", "maskedCard", "merchantOrderId", "orderId",
      "cardBrand", "orderReference", "transactionId", "amount", "currency"
  };

  [HttpPost]
  public JsonResult ValidateSignature()
  {
      string secret = "Payment API Key";
      string signature = Request.QueryString["signature"];
      if (string.IsNullOrEmpty(signature))
      {
          return Json(new { success = false, message = "Missing signature." });
      }
      var parts = new StringBuilder();
      foreach (string field in Fields)
      {
          if (parts.Length > 0) parts.Append("&");
          parts.Append($"{field}={Request.QueryString[field] ?? "null"}");
      }
      byte[] keyBytes = Encoding.ASCII.GetBytes(secret);
      byte[] messageBytes = Encoding.ASCII.GetBytes(parts.ToString());
      using (var hmac = new HMACSHA256(keyBytes))
      {
          byte[] hashMessage = hmac.ComputeHash(messageBytes);
          string computedSignature = ByteToString(hashMessage).ToLower();
          if (computedSignature == signature.ToLower())
          {
              return Json(new { success = true, message = "Signature validated successfully." });
          }
          else
          {
              return Json(new { success = false, message = "Signature validation failed." });
          }
      }
  }
  public static string ByteToString(byte[] buff)
  {
      StringBuilder sbinary = new StringBuilder();
      for (int i = 0; i < buff.Length; i++)
      {
          sbinary.Append(buff[i].ToString("X2")); // hex format
      }
      return sbinary.ToString();
  }
}

paymentStatus, cardDataToken, maskedCard, merchantOrderId, orderId, cardBrand, orderReference, transactionId, amount, currency