adyen.signers module¶

Signers are helpers to sign and verify Adyen requests & responses.

There are currently 2 type of signatures:

SHA-1, deprecated by Adyen but still used,
SHA-2 (256), preferred by Adyen.

Each signer follows different rules to sign payment request form, and to verify Adyen return response and Adyen notification.

Note

About the signature:

The data passed, in the form fields, is concatenated into a string, referred to as the “signing string”. The HMAC signature is then computed over using a key that is specified in the Adyen Skin settings (stored into the AbstractSigner.secret key).

The signature is passed along with the form data and once Adyen receives it they use the key to verify that the data has not been tampered with in transit.

The signing string should be packed into a binary format containing hex characters, and then base64-encoded for transmission.

class adyen.signers.AbstractSigner(secret_key)¶

Bases: object

Abstract base class that define the common interface.

A signer must expose three methods:

sign(): take form fields and return a dict of signature fields.
verify(): take a dict of fields and make sure there have an

appropriate signature field.
compute_hash(): take a signature string and compute its hash value.

These methods are not implementd by the AbstractSigner, therefore subclasses must implement them.

compute_hash(signature)¶

Return a hash for the given signature string.

Parameters:	signature (str) – A `signature` used to compute hash.
Returns:	A hashed version of the `signature` using the `secret_key` and the defined hash algorithm.

Each implementation should simply use a different hash algorithm to sign the signature string. This method is not supposed to know how the signature string is built.

secret_key = None¶

Adyen Skin secret key

This secret key is used to sign payment request, and verify payment return response and payment notification.

sign(fields)¶

Sign the given form fields and return the signature fields.

Parameters:	fields (dict) – The form fields used to perform a payment request
Returns:	A dict of signature fields
Return type:	`dict`

A payment request form must contains specific signature fields, depending on the selected sign method.

verify(fields)¶

Verify fields contains the appropriate signatures.

Parameters:	fields (dict) – A dict of fields, given by a payment return response or by a payment notification.
Returns:	`True` the `fields` contain valid signatures
Return type:	`boolean`

Adyen can secure communication with merchant site using signatures:

merchantSig for the return URL,
additionalData.hmacSignature for notification,

And this method can be used for both, provided with all the fields as a flat dict.

The following example is taken from the Adyen documentation:

{
   "live":"false",
   "notificationItems": [
      {
         "notificationRequestItem": {
            "additionalData": {
               "hmacSignature":"SIGN_KEY"
            },
            "amount": {
               "value":1130,
               "currency":"EUR"
            },
            "pspReference":"7914073381342284",
            # ... other fields
         }
      }
   ]
}

The expected fields will be:

{
    'additionalData.hmacSignature': 'SIGN_KEY',
    'amount.value': 1130,
    'amount.currency': 'EUR',
    'pspReference: "7914073381342284"
    # ... other fields
}

This format correspond to the POST notification format.

class adyen.signers.HMACSha1(secret_key)¶

Bases: adyen.signers.AbstractSigner

Implement a HMAC signature with SHA-1 algorithm.