Checkout/Signature Guide

Signature Guide

Every Create Session request must include an HMAC-SHA256 signature computed from your order fields. Kuickpay verifies this signature to confirm the request is authentic and untampered.

How It Works

Concatenate fields

Join the 5 required fields as strings in the exact order specified, separated by a pipe (|) character.

Compute HMAC-SHA256

Apply HMAC-SHA256 using your SecuredKey (from the Business Portal) as the key and the concatenated string as the message.

Hex-encode the result

Convert the raw bytes to a lowercase hex string and include it as the signature field in the request body.

JavaScript Example

const companyid = "01234";
const orderid = "ORD10001";
const amount = "1000.00";
const amountPayable = "1000.00";
const timestamp = new Date().toISOString();

pm.environment.set("timestamp", timestamp);

const canonical = `${companyid}|${orderid}|${amount}|${amountPayable}|${timestamp}`;

const securedKey = "xWX+A8qbYkLgHf3e/pu6PZiycOGc0C/YXOr3XislvxI=";

const signature = CryptoJS.HmacSHA256(canonical, securedKey).toString(CryptoJS.enc.Base64);

pm.environment.set("signature", signature);

Field Order

Fields must be concatenated in this exact order. The order matters — a different order produces a different signature.

#	Field	Description
1	`companyid`	Your Company ID.
2	`orderid`	Your unique order reference.
3	`amount`	Total order amount.
4	`amountPayable`	Amount the consumer will pay (same as amount or discounted).
5	`timestamp`	ISO 8601 timestamp of the request.

Concatenation result (before HMAC)

COMP001|ORDER-20250506-001|1250.00|1250.00|2025-05-06T10:00:00Z

Code Examples

Node.js

const crypto = require('crypto');

function generateSignature(params, securedKey) {
  // Concatenate fields in this exact order, separated by "|"
  const message = [
    params.companyid,
    params.orderid,
    params.amount,
    params.amountPayable,
    params.timestamp,
  ].join('|');

  return crypto
    .createHmac('sha256', securedKey)
    .update(message)
    .digest('hex');
}

// Usage
const signature = generateSignature({
  companyid:     'COMP001',
  orderid:       'ORDER-20250506-001',
  amount:        '1250.00',
  amountPayable: '1250.00',
  timestamp:     '2025-05-06T10:00:00Z',
}, 'your_secured_key');

Python

import hmac
import hashlib

def generate_signature(params: dict, secured_key: str) -> str:
    # Concatenate fields in this exact order, separated by "|"
    message = '|'.join([
        params['companyid'],
        params['orderid'],
        params['amount'],
        params['amountPayable'],
        params['timestamp'],
    ])
    return hmac.new(
        secured_key.encode(),
        message.encode(),
        hashlib.sha256
    ).hexdigest()

signature = generate_signature({
    'companyid':     'COMP001',
    'orderid':       'ORDER-20250506-001',
    'amount':        '1250.00',
    'amountPayable': '1250.00',
    'timestamp':     '2025-05-06T10:00:00Z',
}, 'your_secured_key')

PHP

<?php
function generateSignature(array $params, string $securedKey): string {
    $message = implode('|', [
        $params['companyid'],
        $params['orderid'],
        $params['amount'],
        $params['amountPayable'],
        $params['timestamp'],
    ]);
    return hash_hmac('sha256', $message, $securedKey);
}

$signature = generateSignature([
    'companyid'     => 'COMP001',
    'orderid'       => 'ORDER-20250506-001',
    'amount'        => '1250.00',
    'amountPayable' => '1250.00',
    'timestamp'     => '2025-05-06T10:00:00Z',
], 'your_secured_key');

using System.Security.Cryptography;
using System.Text;

string GenerateSignature(Dictionary<string, string> p, string securedKey)
{
    var message = string.Join("|",
        p["companyid"], p["orderid"], p["amount"],
        p["amountPayable"], p["timestamp"]
    );
    using var hmac = new HMACSHA256(Encoding.UTF8.GetBytes(securedKey));
    var hash = hmac.ComputeHash(Encoding.UTF8.GetBytes(message));
    return Convert.ToHexString(hash).ToLower();
}

Common mistakes: Using the wrong field order, omitting the pipe (|) separator or adding spaces around it, using a different encoding (e.g. base64 instead of hex), or including extra fields (such as transactiondescription or returnurl) in the concatenation — all produce an invalid signature.

Create a Checkout Session

Handle Return →