Skip to content
Search Articles/

less than a minute read • Updated 2 hours ago

Sign multiple products in one form with HMAC

How to sign add to cart forms that add more than one product at a time using HMAC.

Foxy supports adding multiple products in a single form submission using numeric prefixes on parameter names (e.g. 2:name, 2:price). When signing these forms with HMAC, generate the hash without the numeric prefix.

How it works

Strip the numeric prefix before generating the hash. The prefix is only used to group parameters in the form — it is not part of the value Foxy verifies against.

For example, a form with two products:

<input type="hidden" name="name" value="Example T-Shirt" />
<input type="hidden" name="code" value="abc123" />
<input type="hidden" name="price" value="25" />
<input type="hidden" name="2:name" value="Baseball Hat" />
<input type="hidden" name="2:code" value="hat123" />
<input type="hidden" name="2:price" value="15" />

The hashes are generated without the 2: prefix:

hash_hmac('sha256', 'abc123nameExample T-Shirt', $api_key); // First product
hash_hmac('sha256', 'hat123nameBaseball Hat', $api_key);    // Second product — no "2:" prefix

The signed form inputs look like this:

<input type="hidden" name="name||[hash]" value="Example T-Shirt" />
<input type="hidden" name="code||[hash]" value="abc123" />
<input type="hidden" name="price||[hash]" value="25" />
<input type="hidden" name="2:name||[hash]" value="Baseball Hat" />
<input type="hidden" name="2:code||[hash]" value="hat123" />
<input type="hidden" name="2:price||[hash]" value="15" />

The numeric prefix is kept in the name attribute of the input — it is only excluded from the string passed to the hash function.

Notes

  • A product with no numeric prefix is treated by Foxy as 1:. It is good practice to prefix all products explicitly (e.g. 1:name, 2:name) to avoid any ambiguity.

  • Each product’s parameters are still hashed using only that product’s own code — not a combined code. For bundled products within a multi-product form, see Sign bundled products with HMAC.

  • All other signing rules apply — every parameter must be signed, open fields use --OPEN--, and select/radio inputs use the value attribute. See Sign product forms with HMAC.

Need Help?

Did this article answer your questions? Need help with anything? Please click below to contact us.