---
description: >-
  If you are interested in adding an extra layer of security, please ask your
  account manager to enable postback hashing.
---

# Postback Hashing

## Hashing

Postback hashing is optional. If activated by your account manager, we will add a "\&hash={hash}" parameter to all your postback calls. The {hash} is created using a HEX encoded SHA1 HMAC, generated by hashing the entire postback url with a pre-shared secret key. You will receive the secret key from your account manager and you can use it to verify the hash.

## Example

The purpose of this Node.js code sample is to provide you with an understanding of how to authenticate our hashes:

```javascript
const crypto = require('crypto');

function checkUrlHash(url, secretKey) {
  const urlWithoutHash = url.split('&hash=')[0];
  const hash = url.split('&hash=')[1];
  
  const hmac = crypto.createHmac('sha1', secretKey);
  hmac.update(urlWithoutHash);
  const calculatedHash = hmac.digest('hex');

  return calculatedHash === hash;
}
```

{% hint style="warning" %}
Query string parameters are encoded using **encodeURIComponent** before the hash is calculated and appended. It is important to verify the URL exactly as it is called. This means you need to ensure your server stack **does not automatically decode the URI components**, or checking the hash will fail.
{% endhint %}
