Skip to main content
To confirm your validation logic is functional, perform the following checks:

Valid Request

Confirm that requests with valid signatures return 200 OK.

Invalid Signature

Verify that incorrect HMACs are rejected with 401 Unauthorized.

Tamper Check

Modify one character in the MerchantRequestId to ensure the HMAC fails.

​
Troubleshooting Validation

If your calculated hash does not match the one provided by Nayax, audit your implementation against this checklist:
Ensure you are using the Enum Name string (e.g., "Sale", "Auth") rather than the integer value ("0", "1"). This is a common point of failure.
Ensure booleans are converted to "True" or "False" (with a capital T/F). Lowercase strings like “true” will result in a signature mismatch.
If NayaxTransactionId is missing, the signing string must start with a colon (e.g., :MerchantId...). Ensure you are using a colon (:) as the delimiter.
Verify you are decoding the 64-character hex string into 32 raw bytes before using it as the HMAC-SHA256 key. Do not use the hex string directly.
Verify the order is strictly:
  1. NayaxTransactionId
  2. MerchantRequestId
  3. MachineId
  4. RequestTypeName
  5. IsApproved

​
Response Logic

How your server responds to a validation failure impacts retry behavior.
Important: If HMAC validation fails, do not return 500. Nayax will retry on a 500 response, but it will not retry on a 401. Since a signature mismatch is usually a logic error, retrying will not resolve the issue.