HCO Integration Guide

Hosted Checkout (HCO) allows you to securely accept E-commerce payments by redirecting your customers to E-xact's hosted payment page. This keeps your system out of PCI scope while giving you access to fraud prevention and diverse payment methods.

🚀 Getting Started

To initiate a checkout, your application must generate an HTML form and submit an HTTP POST request to one of the following endpoints:

• Live Environment: https://checkout.e-xact.com/payment
• Sandbox/Demo Environment: https://rpm.demo.e-xact.com/payment

Essential Form Fields

At a minimum, your POST request must include the following hidden fields. If any are missing or invalid, the customer will see an error.

🔐 Hash Calculation (x_fp_hash)

The x_fp_hash parameter ensures that the payment request originated from your server and was not tampered with.

The hash is generated using either HMAC-SHA1, or HMAC-MD5 based on a string combining your transaction variables and your Transaction Key (found in your E-xact Dashboard under Payment Pages > Security).

Standard Hash String Format

Concatenate your values in the following exact order, separated by a caret (^): x_login^x_fp_sequence^x_fp_timestamp^x_amount^x_currency_code

Example Code (Python) - HMAC-SHA1

import hmac
import hashlib
import time

# Credentials and transaction details
transaction_key = b'YOUR_TRANSACTION_KEY'
login_id = 'YOUR_PAYMENT_PAGE_ID'
sequence = '123456' # Unique order/sequence ID
timestamp = str(int(time.time()))
amount = '25.00'
currency = 'USD' # or CAD

# Construct the data string exactly as required by the API
data_string = f"{login_id}^{sequence}^{timestamp}^{amount}^{currency}"

# Generate the HMAC-SHA1 Hash
x_fp_hash = hmac.new(
    transaction_key,
    data_string.encode('utf-8'),
    hashlib.sha1
).hexdigest()

print(f"x_fp_hash: {x_fp_hash}")

Example Code (Node.js) - HMAC-MD5

const crypto = require('crypto');

const transactionKey = 'YOUR_TRANSACTION_KEY';
const loginId = 'YOUR_PAYMENT_PAGE_ID';
const sequence = '123456'; // Unique order/sequence ID
const timestamp = Math.floor(Date.now() / 1000).toString();
const amount = '25.00';
const currency = 'USD'; // or CAD

// Construct the string
const dataString = `${loginId}^${sequence}^${timestamp}^${amount}^${currency}`;

// Generate HMAC-MD5 Hash
const x_fp_hash = crypto.createHmac('md5', transactionKey).update(dataString).digest('hex');

console.log(x_fp_hash);

🛠

Built-in Hash Calculator

Having trouble getting your hash to match? Log in to your E-xact account and navigate to Payment Pages > Hash Calculator. From there you can input raw variables to see exactly what hash E-xact is expecting, making debugging easy.

Transaction and Display Fields

Processing Fields

Receipt Page Fields

Fields Common to Payment Collection and Receipt Page

Transaction Data & Recurring Billing Fields

Order and Customer Detail Fields

Order Information Fields

Customer Name, Billing, and Shipping Address Fields

Additional Customer Data & Amount Fields