Create Deposit Request Control Checksum

NOTE: Never expose your partner_control provided by us to anyone. Doing so will compromise the security of future transaction.

HAMC SHA-1 message digest is used in ensuring data integrity and message authenticity in communication. This message digest is calculated by concatenating the data in transaction request/response in the correct order, feed it into HMAC SHA-1 function using partner control as the key and supplies the HMAC SHA-1 result in control parameter in the transaction request.

To create the checksum, concatenate the value of the following parameters into one string variable in the following order:
(merchant_account + amount + currency + first_name + last_name + address + city + zip_code + country + phone + email + order_no + product_desc + redirect_back_url)

Below example to verify checksum:
merchant_account 123456789
amount 10000
currency PHP
first_name Juan
last_name Dela Cruz
address Barangay 105, Tondo
city Manila
zip_code 1012
country PH
phone +639123456789
email delacruzjuan@sample.com
merchant_order 12345
product_desc Digital Product
redirect_back_url https://www.sample.com/fe/redirect.php

The complete string for above example data becomes as follows:
12345678910000PHPJuanDela CruzBarangay 105, TondoManila1012PH+639123456789delacruzjuan@sample.com12345Digital Producthttps://www.sample.com/fe/redirect.php

For this example partner_control key is: D6909744CDF0C6BDC87603900E3EE881

Then hash the string using the HMAC SHA-1 hash function (Example below):
hash_hmac(‘SHA1’, ‘12345678910000PHPJuanDela CruzBarangay 105, TondoManila1012PH+639123456789delacruzjuan@sample.com12345Digital Producthttps://www.sample.com/fe/redirect.php’, ’D6909744CDF0C6BDC87603900E3EE881’)

Then supply this string and the partner control as the key to HMAC SHA-1 function. And supply the result to control parameter, the last parameter you need to initiate the transaction. In our example, the control parameter would become:

50eac75f3e4e6b0db92c7b1a585c2410a77cceb9

Deposit Callback Response

After processing request of transaction, our system redirect the customer back to merchant website using the parameter redirect_back_url. At the same time, we send the same transaction result via server-to-server communication if status_callback_url contains valid URL value. Most of the parameters simply echo from transaction message, with information about the bank used and the status of the attempted transaction. The table below explains the parameters that are delivered by HTTP POST request in JSON format.

# Callback response example :
{
    "transaction_id":"987654321",
    "merchant_order":"12345",
    "amount":"10000",
    "currency":"PHP",
    "bank_transaction_id":"123456789",
    "status":"A0",
    "control":"4cac5b736c357ff073cc50ae2708f333e6066805",
    "message": "Paid / Refunded / Successful requested."
}
                

CALLBACK RESPONSE PARAMETERS IN JSON BODY

Validate your Deposit Callback Response by matching Control Checksum

HAMC SHA-1 message digest is used in ensuring data integrity and message authenticity in communication. This message digest is calculated by concatenating the data in transaction result in the correct order and use the shared secret (partner_control) as the key, feed it into HMAC SHA-1 function and supply the HAMC SHA-1 function result in control parameter of the request.

To create the checksum from callback response, concatenate the value of the following parameters into one string variable in the following order:
(transaction_id + merchant_order + amount + currency + bank_transaction_id + status)

Below example to verify checksum:
transaction_id 987654321
merchant_order 12345
amount 10000
currency PHP
bank_transaction_id 123456789
status A0

The complete string for above example data becomes as follows:
9876543211234510000PHP123456789A0

For this example partner_control key is: D6909744CDF0C6BDC87603900E3EE881

Then hash the string using the HMAC SHA-1 hash function (Example below):
hash_hmac(‘SHA1’, ‘9876543211234510000PHP123456789A0’, ’D6909744CDF0C6BDC87603900E3EE881’)

Then supply this string and the partner control as the key to HAMC SHA-1 function. And supply the result to control parameter, the last parameter you need to initiate the transaction. In our example, the control parameter would become:

4cac5b736c357ff073cc50ae2708f333e6066805