15
Views
2
Comments
Solved
how to generate Generate HMAC-SHA256 hash ?
Question
Application Type
Reactive

the code in php to generate a signature  is like this

<?php


function generateDokuSignature(

    string $clientId, 

    string $sharedKey, 

    string $requestTimestamp, 

    string $requestTarget, 

    string $digest

): string {

    // 1. Concatenate the components in the exact order required by DOKU

    // Formula: Client-Id + Request-Timestamp + Request-Target + Digest

    $signatureComponent = $clientId . $requestTimestamp . $requestTarget . $digest;


    // 2. Generate HMAC-SHA256 hash using the Shared Key

    // The third parameter is the key (Shared Key), the second is the data (Component)

    $rawSignature = hash_hmac('sha256', $signatureComponent, $sharedKey, true);


    // 3. Convert the binary hash to a Hexadecimal string

    $finalSignature = bin2hex($rawSignature);


    return $finalSignature;

}


// ==========================================

// USAGE EXAMPLE

// ==========================================


// 1. Your Credentials (Get these from DOKU Dashboard -> Settings -> Integration)

 $client_id = "BRN-0225-xxxxxx"; 

 $shared_key = "SK-xxxxxxxxx"; 


// 2. Request Details

// Timestamp must be ISO 8601 format (UTC) or as required by specific endpoint

 $request_timestamp = "2023-11-01T10:00:00Z"; 


// The API Path you are calling (e.g., for Checkout Page)

 $request_target = "/checkout-pages/v1/payment"; 


// The Digest you calculated from the JSON Body (Base64(SHA256(Body)))

// Example Digest: "X4kZ8v..." (This is just a placeholder, use your actual calculation)

 $request_digest = "X4kZ8v..."; 


// 3. Generate the Signature

 $signature = generateDokuSignature(

    $client_id,

    $shared_key,

    $request_timestamp,

    $request_target,

    $request_digest

);


echo "Generated Signature: " . $signature;


?>


what function to use t o generate HMAC-SHA256 hash ?

thanks

2026-01-28 16-57-48
Mihai Melencu
Champion
Solution

Hi,

You can use ComputeMac from CryptoAPI. By default, it uses HMAC-SHA256 as the algorithm, so it should match the PHP hash_hmac('sha256', ...) logic. 


2025-01-09 14-56-57
IQ78

when concatenating clientid + '\n' , use chr(10) instead for the doku payment gateway, do not use NewLine function or '\n'

Community GuidelinesBe kind and respectful, give credit to the original source of content, and search for duplicates before posting.