How to use the postback hash checker
Paste the full postback URL from your server log, and the checker fills in the transaction ID, user ID, reward, status, and hash when your parameters use common names. Otherwise, type the four values yourself. Add your postback secret key from your dashboard under Apps, your app, Integration, and the checker shows the exact string that is signed, the hash you should get, and whether it matches. Nothing leaves your browser.
How the postback hash is built
string = transaction_id:user_id:reward:status
hash = HMAC-SHA256(string, postback_secret_key), as lowercase hexUse the four values exactly as they arrive. The reward is sent without trailing zeros, for example 1500 or 0.5. The postback docs show the check in PHP, Node.js, and Python, with a constant-time comparison.
Why a postback hash does not match
- Wrong key. The postback secret key is not the link hash salt. They are two different secrets.
- Reformatted reward. Parsing the reward into a number and printing it again turns
1500into1500.00or1500.0. Hash the original string. - Wrong order or separator. The order is transaction ID, user ID, reward, status, joined with single colons.
- Encoding. Use the URL-decoded values your framework gives you, not the raw query string.
- Uppercase hex. The hash is lowercase. Compare it as it arrives.
Once the hash matches, credit each transaction once: how to prevent duplicate credits. To send yourself a real signed postback, use Send a test postback on the Integration tab of your app.
Frequently asked questions
Which values are in the Moonetix postback hash?
The transaction ID, user ID, reward, and status, joined with colons, signed with HMAC-SHA256 and your postback secret key.
Is the reversal postback signed the same way?
Yes. A reversal has status 2 and the same transaction ID as the credit, and its hash is built the same way.
Why does my code fail while this checker matches?
Your code changes one of the values before hashing, usually the reward format or the key. Print the exact string your code signs and compare it with the one shown here.
Is it safe to paste my secret key?
The page never sends it anywhere, but use a test app or rotate the key afterwards if you are unsure.