Name: Configuring Notification Authentication in Open Payment Framework
Uploaded: 2025-7-1
Duration: 226 s
Description: In this video, you'll learn how to configure secure notification authentication in OPF using Stripe's Hash-based Message Authentication Code (HMAC) signature method. We'll walk through setting up a secret key, building the signing string for verification with FreeMarker, and updating your endpoint to ensure only authentic notifications are accepted.

Share feedback

<p><u><strong>Planned maintenance of Practice Systems</strong></u></p>

Planned maintenance of Practice Systems

Why create an SAP account?

Enhance your learning experience

SAP Learning

Choose your subscription

Manage your subscription

Live Sessions

Hands-on Practice

Certification

My Learning

Ready to start learning?

<div><div><div><div><div>In this video, you'll learn how to configure secure notification authentication in OPF using Stripe's Hash-based Message Authentication Code (HMAC) signature method. We'll walk through setting up a secret key, building the signing string for verification with FreeMarker, and updating your endpoint to ensure only authentic notifications are accepted.</div></div></div></div></div>

Configuring Notification Authentication in Open Payment Framework

Hello. In this video, I'll demonstrate how to configure authentication for notifications in OPF.  Before we begin, I'll navigate to the authorization verification request section and  and unmap the PSP reference.  This is because the responsibility for verification now shifts to the notification process,  where the PSP reference and reference ID have been mapped accordingly. Now, returning to the notification configuration section.  Authentication is essential to secure our endpoints.  Without it, any user could send unauthorized post-requests,  potentially leading to information theft.  As Stripe's documentation on manual notification verification outlines, notification authentication often leverages HMAC signatures.  These use a secret key, hashed with SHA-256 to create a unique signature for each notification.   Let's configure this.  First, I'll navigate to the web hook configuration page within the PSP sandbox.  I'll edit the destination and filter the received events,  selecting only charge succeeded for this example.  I'll save the destination, as you can see,  a signing secret is provided, crucial for validating the payload.  Now, switching to OPF in the notification general configuration session, I'll add a new authentication method.  OPF offers various authentication types,  including Basic Auth, allowlisting, and signature authentication.  For this demo, I'll select Signature authentication. This method supports both the Digest Signature Type and HMAC.  For HMAC, we need to enter the secret key.  I'll copy the secret from the PSP sandbox and paste it into the field.  There's no special encoding required.  The HMAC algorithm is SHA-256,  as per the documentation.   The character set remains UTF-8,  and Stripe generates base 16 lowercase signatures, as shown in the example.  Now, for the slightly more complex part, generating the signing string.  Stripe uses an algorithm involving a timestamp and the signed payload.   The manual steps are outlined here.  OPF utilizes free marker to build signing strings and extract comparison values.  Let's build the signing string, which consists of a timestamp,  a dot, and the body.  Adding the body and the dot is simple.   I've prepared a free marker script to extract the timestamp from the stripe signature header.   This script parses the comma-separated header string,  identifies key value pairs, and extracts the timestamp value if it starts with t= This signing string is then hashed with SHA-256 using the secret key and  This signing string is then hashed with SHA-256 using the secret key and  compared against the straight signing string.  A similar FreeMarker script is used to extract the V1 value  from the Stripe signature for comparison.  I'll name this authentication method and save it.   Finally, I'll update the notification endpoint to use this authentication method.    This ensures that future notifications are authenticated,  preventing unauthorized messages from third parties without the secret. Thank you for watching!