Validating Incoming IPN notifications

If you have IPN turned ON, our server will send IPN notifications to the URL you have entered on the IPN Settings page inside your account (Merchant Services >> IPN Settings).

Notifications are always sent via POST as field=value pairs. All notifications also contain at the end a signature key that will help you check if this notification is VALID or INVALID.

Notification Sample:

https://www.mystore.com/ipn/
POST
field1=value1&field2=value2&...&fieldN=valueN&key=1060b7b46a3bd36b3a0d66e0127d0517

If you have IPN turned ON, our server will send IPN notifications to the URL you have entered on the IPN Settings page inside your account (Merchant Services >> IPN Settings).

(1) Take the DATA that came via POST to your IPN listener (except key field). The field=value pairs should be in the exact same order and be separated by "&".

data = "field1=value1&field2=value2&...&fieldN=valueN"

(2) Calculate your own key based on the input data using the formula:

calculated_key = MD5(data + sharedSecret)

data = data calculated at step (1) sharedSecret = your IPN shared secret witch you can get by email from Merchant Services >> IPN Settings \+ = string concatenation

(3) compare "calculated_key" against "key". If they match the notification is VALID, otherwise the notification is INVALID.

IPN Message Validation Sample PHP Code

<?php
// Getting Raw POST Data
$rawPostedData = file\_get\_contents('php://input');
// Extracting Field=Value Pairs
$i = strpos($rawPostedData, "&key=");
$fieldValuePairsData = substr($rawPostedData, 0, $i);
// Calculating Key (Notification Signature)
$calculatedKey = md5($fieldValuePairsData . your\_ipn\_shared_secret);
// Verifying Notification Key (Signature)
$isValid = $_POST\["key"\] == $calculatedKey ? true : false;
if(!$isValid)
{
    echo "This is not a valid notification message";
    exit;
}
//TODO: Process notification here
?>

Next :
IPN Notification Parameters