**If you find this helpful please kudo this post. This has consumed a huge chunk of my day and you will help me build credibility for when I enroll in the authorize.net certified developer program. **
Here is 100% tested, working php hash verification code for the php SDK. I believe this will also work with SIM/AIM, etc.
You need the following to have an apples to apples setup with what I used:
1: The most recent php SDK package from GitHub. I downloaded this today and installed. I believe it is a few days old.
2: If you have not generated a signature key from your production or sandbox merchant interface to use for testing, do so. You won’t get the hash in the response without it. Generate it and copy it for use in this script.
3: An API call script for some payment transaction that returns the hash. With the SDK I am getting this for voidTransaction, refundTransaction, capture, etc. I believe that any payment function that directly charges or affects a transaction will contain this. The Accept Hosted form API call obviously does not.
For requirement 1, the SIM/DPM, etc. users do not have this, if my understanding is correct. You should be able to use this as well, only substituting my method for extracting the transHashSha2 value from the response with however you accomplish this using your integration. You may also have to use different parameters in your delimited string, I would try this method first, but I have seen other developers posting attempts with more fields in the string than login, transId, and amount, and there is probably a good reason for this.
Here is the code (p.s. do not follow the hyperlink to the C# byte array description and try to implement a php equivalent to the C# byte array script. This makes things 100X harder than they have to be, as I know well at this point. Without further delay…..)
$login = "copy and paste your merchant login id here";
$signatureKey ="copy and paste your signature key here";
$signatureKey = hex2bin($signatureKey);
$amount = $amount;
//$response stands for the response object returned by your API call
//e.g. $response = refundTransaction($refTransId,$amount,$lastFour);
$transId = $response->getTransactionResponse()->getTransId();
$string = '^'.$login.'^'.$transId.'^'.$amount.'^';
$hash = $response->getTransactionResponse()->getTransHashSha2();
$digest = strtoupper(HASH_HMAC('sha512',$string,$signatureKey));
if(hash_equals ($digest,$hash)){
//This if statement is the verification piece
//Put whatever you want your app to do with the transaction here
//to test you can do something like echo "Hash verification validated";
//or try this:
//$dump = print_r($string,true);
//$fp = file_put_contents( 'transhash.log', $dump );
//and if your directory populates with a file named transhash.log you know
//verification succeeded
}
