I'm using Authorize.net payment method which is by default provided by Magento.

Recently Authorize.net going to upgrade transaction hash. So, do I need to change anything in my Magento ?


  • Any buddy can say what I have to do with this?
    – Magecode
    Feb 7, 2019 at 6:20
  • This statement is incorrect! "So if you are not using Authorize.Net Direct Post method in magento you don't have to worry." We are using Authorize.net in Magento 1.9 completely patched with SUPEE 11085 just in case and I can confirm that as of 3-16-19, our site is now broken over this issue. Trying to figure out how to implement the SHA-512 Signature key in Authorize.net transactions or else be forced to go to DPM.
    – jc1110
    Mar 21, 2019 at 0:15
  • This does not provide an answer to the question. Once you have sufficient reputation you will be able to comment on any post; instead, provide answers that don't require clarification from the asker. - From Review Mar 21, 2019 at 4:06

2 Answers 2


Solution: Check out the latest update with patches from the Magento site regarding this issue: https://support.magento.com/hc/en-us/articles/360024368392 This solves the issue! For community editions download the patch from https://magento.com/tech-resources/download for magento 1 check for Authorize.net Direct Post Signature Key patch in Release Archive and for version 2 in Magento Open Source Patches - 2.x

Authorize.Net phases out MD5 based hashes used for transaction response verification. Phase 1 means that merchants are no longer able to configure or update their MD5 Hash settings in the Merchant Interface. This will have severe impacts on merchants who use or are interested in using the Authorize.Net Direct Post method in Magento. So if you are not using Authorize.Net Direct Post method in magento you don't have to worry.

If you want to fix the directpost method you will have to do redo the hash calculation with the new APISignatureKey :

 $hash_data  = "^" .$merchantApiLogin . "^" . $transactionId . "^" . $amount."^" ;
 $local_hash = hash_hmac("sha512", $hash_data, pack("H*", $APISignatureKey));

and then the hash validation with transHashSHA2 instead of x_MD5_Hash.

The issue of the delimiter character has nothing to do with this!

By the way the mentioned Vonnda patch https://github.com/vonnda/Vonnda_AuthorizePatch/ is not related to this md5 upgrade issue, it addresses in a wrongful manner the following issue: https://community.magento.com/t5/Magento-1-x-Technical-Issues/Authorize-net-Gateway-Errors-without-Message/m-p/119112/highlight/true#M9284 which was fixed by Zoey see here https://blog.zoey.com/important-authorize-net-problem-may-mean-missed-orders


First Please check this link for reference discussion about Authorize.net change MD5 to SHA-512 by Magento Maintenance support


For Magento 1.9 here is possible fix for (a change made regarding the support of the delimiter character from any string to only a single character).


For Magento 2

The new official Magento 2 core module that is nearing completion and is scheduled to be available in 2.3.1 will support the new algorithm as well as the old. Authorize.net documentation states that both will continue to function but the old md5 option will no longer be in their interface

I hope this will help

  • I'm asking about Authorize.net not Authorize.net Direct Post. Can you please give answer for this?
    – Magecode
    Feb 11, 2019 at 4:59

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.