Are you looking for test card numbers?

Would you like to contact support?

Atenção, esta página não se encontra disponível em Português
Developer-resource icon

Verify HMAC signatures

Verify the integrity of notifications using HMAC signatures.

To protect your server from unauthorised notifications, we strongly recommend that you use Hash-based message authentication code (HMAC) signatures. After you enable HMAC signatures, each notification will include a signature calculated using a secret HMAC key and a payload from the notification. By verifying this signature, you confirm that the notification was sent by Adyen, and was not modified during transmission.

To verify HMAC signatures, you can either:

Enable HMAC signatures

To enable HMAC signed notifications, it is enough to generate a secret HMAC key in your Customer Area. The secret key is linked to a Standard Notification endpoint. If you have multiple endpoints for receiving notifications, you need to generate an HMAC key for each of them.

You also need to generate a new HMAC key when you switch from test to live.

To start receiving HMAC signed notifications:

  1. Log in to your Customer Area. If you have set up notifications at the merchant level, switch to your merchant account.
  2. Go to SettingsWebhooks.
  3. Find the Standard Notification endpoint for which you want to enable HMAC, and click Edit & Test.
  4. Under Additional settings, click Generate New HMAC key.
  5. Securely store the HMAC key in your system - you won't be able to restore it later.
  6. Click Save Configuration.

The HMAC key will now be used to sign notifications that we send to your server. The signature is
included in the additionalData field:


If you generate a new HMAC key, make sure that you can still accept notifications signed with your previous HMAC key for some time, because:

  • It might take some time to propagate the new key in our infrastructure.
  • HMAC signatures are calculated when the notification is generated, so any notifications queued before you saved the new key are signed using your previous key.

Verify using our libraries

You can verify signatures using our:

String hmacKey = "YOUR_HMAC_KEY";
// YOUR_HMAC_KEY from the Customer Area
String notificationRequestJson = "NOTIFICATION_REQUEST_JSON";
HMACValidator hmacValidator = new HMACValidator();
NotificationHandler notificationHandler = new NotificationHandler();
NotificationRequest notificationRequest = notificationHandler.handleNotificationJson(notificationRequestJson);
// Handling multiple notificationRequests
List<NotificationRequestItem> notificationRequestItems = notificationRequest.getNotificationItems();
for ( NotificationRequestItem notificationRequestItem : notificationRequestItems ) {
    if ( hmacValidator.validateHMAC(notificationRequestItem, hmacKey) ) {
        // Handle the notification
        String eventCode = notificationRequestItem.getEventCode();
        // Process the notification based on the eventCode
    } else {
        // Non valid NotificationRequest
        System.out.print("Non valid NotificationRequest");
$hmacKey = "YOUR_HMAC_KEY";
// YOUR_HMAC_KEY from the Customer Area
$notificationRequest = json_decode($jsonRequest, true);

$hmac = new \Adyen\Util\HmacSignature();
foreach ( $notificationRequest["notificationItems"] as $notificationRequestItem ) {
  $params = $notificationRequestItem["NotificationRequestItem"];
  if ( $hmac->isValidNotificationHMAC($hmacKey, $params) ) {
    $eventcode = $params['eventCode'];
    // Process the notification based on the eventCode
  } else {
    // Non valid NotificationRequest
string hmacKey = "YOUR_HMAC_KEY";
// YOUR_HMAC_KEY from the Customer Area
string notificationRequestJson = "NOTIFICATION_REQUEST_JSON";
var hmacValidator = new HmacValidator();
var notificationHandler = new NotificationHandler();
var handleNotificationRequest = notificationHandler.HandleNotificationRequest(notificationRequestJson);
// Handling multiple notificationRequests
List<NotificationRequestItemContainer> notificationRequestItemContainers = handleNotificationRequest.NotificationItemContainer;
foreach ( var notificationRequestItemContainer in notificationRequestItemContainers ) {
    var notificationItem = notificationRequestItemContainer.NotificationItem;
    if ( hmacValidator.IsValidHmac(notificationItem, hmacKey) ) {
        string eventCode = notificationItem.EventCode;
        // Process the notification based on the eventCode
    } else {
        // Non valid NotificationRequest
const { hmacValidator } = require('@adyen/api-library');
const hmacKey = "YOUR_HMAC_KEY";
// YOUR_HMAC_KEY from the Customer Area
const validator = new hmacValidator()
const notificationRequest = NOTIFICATION_REQUEST_JSON; // Notification Request JSON
const notificationRequestItems = notificationRequest.notificationItems
notificationRequestItems.forEach(function(notificationRequest) {
    if( validator.validateHMAC(notificationRequestItem, hmacKey) ) {
        const eventCode = notificationRequestItem.eventCode;
        // Process the notification based on the eventCode
    } else {
        // Non valid NotificationRequest
        console.log("Non valid NotificationRequest");

Verify using your own solution

To build your own solution for verifying HMAC signatures, follow these steps:

Step 1: Construct the payload

The values used below are from an example notification. To test your solution, replace the values with actual values that you receive in a notification.

Concatenate the following values from the notification, in the given order:

Key Value
pspReference 7914073381342284
merchantAccountCode TestMerchant
merchantReference TestPayment-1407325143704
value 1130
currency EUR
success true

Assign an empty string to any fields that are empty, and use a colon (":") to delimit the values.

For the above values, with an empty originalReference, you get:


Step 2: Calculate the HMAC signature

  1. Calculate an HMAC using:

    • The SHA256 function.
    • Binary representation of the payload that you constructed in Step 1, given the UTF-8 charset.
    • Binary representation of the HMAC key, given the UTF-8 charset.
  2. To get the final signature, Base64-encode the result.

Step 3: Compare signatures

If the signature that you calculated in Step 2 matches the hmacSignature that you received, you'll know that the notification was sent by Adyen and was not modified during transmission.


Sample HMAC key:


Sample notification signed using the above HMAC key:


See also