Signature Verification

Zoho Payments generates a signature to ensure the security and integrity of the transaction data. Signature verification confirms that the data has not been tampered with and authenticates the payment details received after a transaction. Signature verification can be performed for payments received via:

• Widget Response
• Return URL

Widget Response

After initiating the payment successfully, the checkout widget will return a response with the payment_id and a signature. The signature will be included only if you’ve generated a signing key under Settings > Developer Space. Once the payment is completed, the widget returns the following parameters:

To verify the signature:

1. Use the following parameters, concatenate them in this order, and use a pipe (|) as the separator:

payment_id | payment_session_id

2. Generate an HMAC-SHA256 signature using the concatenated string and your signing key.

3. Compare the generated signature with the signature parameter for validation.

Successful validation confirms that the data is secure and has not been tampered with.

Return URL

Signature verification for the return URL ensures data integrity and confirms the authenticity of the response returned via payment links. The parameters shown in the table below are sent through the return URL, which is the page the customer is redirected to after a successful payment.

To verify the signature:

1. Extract the following parameters from the return URL and concatenate in this order and use period (.) as a separator:

payment_link_id.payment_id.amount.status.payment_link_reference

2. Generate an HMAC-SHA256 signature using the concatenated string and your signing key.

3. Compare the generated signature with the signature parameter from the return URL.

Successful validation confirms that the data is secure and has not been tampered with.