Skip to content
Search Articles/

less than a minute read • Updated 2 hours ago

Sign bundled products with HMAC

How to sign add to cart links and forms for bundled products using HMAC.

Signing bundled products with HMAC requires a small change to the standard signing process. Because child products often have a different price when sold as part of a bundle, Foxy requires the hash for each child product parameter to include both the child code and the parent code.

How it works

For child product parameters, concatenate the child code and parent code together (in that order, no separator) and use that combined string as the code when generating the hash.

For example, a child product with code of poster belonging to a parent with code of shirt:

hash_hmac('sha256', 'postershirtnameMy Poster', $api_key);
hash_hmac('sha256', 'postershirtprice1.99', $api_key);

The parent product is signed as normal using only its own code:

hash_hmac('sha256', 'shirtnameExample T-Shirt', $api_key);
hash_hmac('sha256', 'shirtprice25', $api_key);

Steps

  1. 1

    Sign the parent product parameters as normal, using only the parent code.

  2. 2

    For each child product parameter, concatenate the child code + parent code into a single string and use that as the code when generating the hash.

  3. 3

    Apply the resulting hashes to the child product inputs as you would for any other signed field.

PHP helper function

Pass the parent code as the fourth argument to the helper function when signing child product parameters:

get_verification('code', 'poster', 'poster', 'shirt');
get_verification('name', 'My Poster', 'poster', 'shirt');
get_verification('price', '1.99', 'poster', 'shirt');

In a form, the signed child product inputs look like this:

<input type="hidden" name="<?php echo get_verification('code', 'poster', 'poster', 'shirt'); ?>" value="poster" />
<input type="hidden" name="<?php echo get_verification('name', 'My Poster', 'poster', 'shirt'); ?>" value="My Poster" />
<input type="hidden" name="<?php echo get_verification('price', '1.99', 'poster', 'shirt'); ?>" value="1.99" />
<input type="hidden" name="<?php echo get_verification('parent_code', 'shirt', 'poster', 'shirt'); ?>" value="shirt" />

Notes

  • The combined code format is {childcode}{parentcode} with no separator.

  • The parent_code parameter itself must also be signed using the same combined code.

  • For select or radio inputs on child products, append the hash to the value attribute as you would for any other form — see Sign product forms with HMAC.

Need Help?

Did this article answer your questions? Need help with anything? Please click below to contact us.