Request Hash (MD5)

POST /payment/s2s/sale requires a hash field to verify request integrity.

Critical: Generate the hash on your server only. Never compute or expose the hash in client-side JavaScript.

Hash inputs (JSON)

{
  "customerEmail": "[email protected]",
  "cardNumber": "4111111111111111",
  "first6": "411111",
  "last4": "1111",
  "apiKey": "YOUR_MERCHANT_API_KEY"
}

Formula

hash = MD5( reverse(customer.email) + apiKey + reverse(first6 + last4) )

Where:

reverse(str) = characters of str in reverse order
first6 = first 6 digits of card number
last4 = last 4 digits of card number
apiKey = your merchant API key (same value as x-api-key header)

Example (Node.js)

const crypto = require('crypto');

function reverse(s) {
  return s.split('').reverse().join('');
}

function computeSaleHash({ email, cardNumber, apiKey }) {
  const first6 = cardNumber.slice(0, 6);
  const last4 = cardNumber.slice(-4);
  const payload = reverse(email) + apiKey + reverse(first6 + last4);
  return crypto.createHash('md5').update(payload).digest('hex');
}

Example (PHP)

<?php
function digetpayS2sHash(string $email, string $cardNumber, string $apiKey): string
{
    $card = preg_replace('/\s+/', '', $cardNumber);
    $reversedEmail = strrev($email);
    $reversedCard = strrev(substr($card, 0, 6) . substr($card, -4));
    $raw = strtoupper($reversedEmail . $apiKey . $reversedCard);
    return md5($raw);
}

Full integration: Embedded Integration — PHP.

Complete sale request payload

{
  "orderId": "ORD-1001",
  "amount": 10.00,
  "currency": "SAR",
  "paymentMethod": "card",
  "auth": "N",
  "card": {
    "cardNumber": "4111111111111111",
    "cardExpiryMonth": "12",
    "cardExpiryYear": "2028",
    "cardCvv": "123",
    "cardHolder": "Ahmed Ali"
  },
  "customer": {
    "name": "Ahmed Ali",
    "email": "[email protected]",
    "phone": "501223324"
  },
  "successUrl": "https://yourstore.com/payment/success",
  "failureUrl": "https://yourstore.com/payment/failure",
  "hash": "COMPUTED_MD5_HEX_DIGEST"
}

Flow

flowchart LR
    A[Collect card + customer email] --> B[Extract first6 + last4]
    B --> C[Build hash string]
    C --> D[MD5 hex digest]
    D --> E[Include as hash in sale body]
    E --> F[POST /payment/s2s/sale]

Never compute the hash in client-side JavaScript exposed to browsers. Generate the hash on your server only.

Invalid hash: Returns 400 Bad Request with Invalid request hash. Double-check email, card digits, and API key used in the formula.

Verified request: Include the computed hash in the JSON body before calling Direct Sale.