I’m running into an issue when using PHP to generate the Hmac message signature for use with a snappay hosted payment page.

I confirmed that my snappay staging account is working correctly by creating the signature using the JavaScript cryptojs library and submitting several test transactions.

However, whenever I try using PHP to generate my message signature the snappay API returns an invalid signature error.

After some troubleshooting it appears that the PHP base64 encoded secret key variable is returning different values than the cryptojs base64 encoded variable.

Please see code snippets below. How can I get the PHP to match to cryptojs encoding?

PHP:

$payloadRaw = sprintf(
    '%s%s%s%s%s%s%s%s%s',
    $accountid,
    $customerid,
    $merchantid,
    $transactionamount,
    $currencycode,
    $paymentmode,
    $email,         
    $nonceid,
    $requestTimeStamp
);  
$secret_key = 'p2v9Im9+gr4RRts2MddoZm1DcOY+MK7/1LBqU7Ztpdc=';   // Fake key
$secretkeyBase64 = base64_encode($secret_key); // Does not match JavaScript
$signatureHash = hash_hmac('sha256', $payloadRaw, $secretkeyBase64, true);

JavaScript:

var secretkey = CryptoJS.enc.Base64.parse(secret_key);  
var txtnonce = "<?php echo "$nonceid"?>"; 
var txttimestamp = "<?php echo "$requestTimeStamp"?>";  
var prehash = CryptoJS.enc.Utf8.parse(payloadRaw);    
var hash = CryptoJS.HmacSHA256(prehash, secretkey);
var hashInBase64 = CryptoJS.enc.Base64.stringify(hash);
var signatureData = hashInBase64 + ":" + txtnonce + ":" + txttimestamp;
var prehash1 = CryptoJS.enc.Utf8.parse(signatureData);      
var HmacValueJS = prehash1.toString(CryptoJS.enc.Base64);

Input - payloadRaw:

8373936484997002300349998556100.00USDCCsample@email.com6ad552829665012b695bbdf72ae2ab31de7e6eac7a94a6d4fa9412cda1961c7a1649797291

Output - Example Signatures and Secret Key encoding:

Signature Correct JS Base64: ZUUvTjBxMG55NUlteUxvMWVJeUd3cUo3cXViakNOWkpkaytOQUd6U3lSaz06NmFkNTUyODI5NjY1MDEyYjY5NWJiZGY3MmFlMmFiMzFkZTdlNmVhYzdhOTRhNmQ0ZmE5NDEyY2RhMTk2MWM3YToxNjQ5Nzk3Mjkx

SecretKey CryptoJS.enc.Base64.parse JS: a76bfd226f7e82be1146db3631d768666d4370e63e30aeffd4b06a53b66da5d7

Signature Wrong PHP Base64: SnhUMTBWRnZBS2txYThld2JhTlVnenJudzRzMVAvYUpldjlrYXRPS0xvST06NmFkNTUyODI5NjY1MDEyYjY5NWJiZGY3MmFlMmFiMzFkZTdlNmVhYzdhOTRhNmQ0ZmE5NDEyY2RhMTk2MWM3YToxNjQ5Nzk3Mjkx

SecretKey base64_encode PHP: cDJ2OUltOStncjRSUnRzMk1kZG9abTFEY09ZK01LNy8xTEJxVTdadHBkYz0=