Every payment request carries a hash_key — an encrypted signature that binds the request to merchant's secret so cannot be forged or replayed against a different order. The hash is built by joining the relevant fields with |, encrypting them with AES-256-CBC using your app_secret , and packaging the IV, salt and ciphertext together.| Endpoint | Signature Fields |
|---|
walletCheckout | total | currency_code | merchant_key | invoice_id |
walletPay | invoice_id | merchant_key |
Why walletPay's hash omits the amount: the transient token returned by the wallet button is wallet provider-signed and single-use, so it already carries the amount/currency and provides replay protection. The hash only needs to bind the invoice and merchant.
Reference implementation (PHP)#
Amount formatting. When validating, Sipay normalizes total to 4 decimal places (number_format($total, 4, '.', '')). Make sure the total sign matches the total sending in the request body — they only need to be numerically equal (e.g. 10, 10.00 and 10.0000 all match).
