Skip to main content

Callback validation

A callback will be provided with the following HTTP headers that will let you validate that the call is genuine:

  • X-Merchant: Your API login
  • X-Checksum: A checksum computed from the request body and the shared passphrase
  • X-Event-Id: Event unique ID
  • X-Event-Date: Event creation date, as timestamp

The checksum is computed the following way:

HEX_SHA1(REQUEST_BODY + PASSPHRASE)

Example code (PHP)​

<?php

$keys = array(
    'login1' => 'passphrase1',
    'login2' => 'passphrase2'
);

$merchant  = $_SERVER['HTTP_X_MERCHANT'];
$checksum  = $_SERVER['HTTP_X_CHECKSUM'];
$eventId   = $_SERVER['HTTP_X_EVENT_ID'];
$eventDate = $_SERVER['HTTP_X_EVENT_DATE'];

$body = file_get_contents('php://input');

if (!isset($keys[$merchant])) {
    die("Unknown merchant login");
}

$shouldBe = sha1($body . $keys[$merchant]);

if ($checksum === $shouldBe) {
    // Request is validated
}