Verify Payment Signature using JavaScript

To verify a payment signature, generate your own signature on your server using the following format:

Create a signature on your server

• orderId: Retrieve the orderId from your server
• paymentId: This field will be available in the success/failure response
• clientSecret: You will receive this information during the onboarding process

Use the SHA256 algorithm, as given below

const crypto = require('crypto');
function generateHMAC(key, data) {
  const hmac = crypto.createHmac('sha256', key);
  hmac.update(data);
  return hmac.digest('hex');
}
const secretKey = '<clientSecret>';
const message = 'orderId|paymentId';
const generatedSignature = generateHMAC(secretKey, message);
if (generatedSignature == signature) {
  // Payment signature is validated. You can now update the transaction status.
}

If the signature you generate on your server matches the signature returned to you, the payment received is from an authentic source.