> For the complete documentation index, see [llms.txt](https://make-money.gitbook.io/integration/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://make-money.gitbook.io/integration/overview/postback-hashing.md).

# Postback Hashing

## Hashing

Postback hashing is optional. If activated by your account manager, we will add a "\&hash={hash}" parameter to all your postback calls. The {hash} is created using a HEX encoded SHA1 HMAC, generated by hashing the entire postback url with a pre-shared secret key. You will receive the secret key from your account manager and you can use it to verify the hash.

## Example

The purpose of this Node.js code sample is to provide you with an understanding of how to authenticate our hashes:

```javascript
const crypto = require('crypto');

function checkUrlHash(url, secretKey) {
  const urlWithoutHash = url.split('&hash=')[0];
  const hash = url.split('&hash=')[1];
  
  const hmac = crypto.createHmac('sha1', secretKey);
  hmac.update(urlWithoutHash);
  const calculatedHash = hmac.digest('hex');

  return calculatedHash === hash;
}
```

{% hint style="warning" %}
Query string parameters are encoded using **encodeURIComponent** before the hash is calculated and appended. It is important to verify the URL exactly as it is called. This means you need to ensure your server stack **does not automatically decode the URI components**, or checking the hash will fail.
{% endhint %}