Security
To avoid this type of security threats, the solution is to store the Shared Key to a server in a trusted
environment. Then there are two basic approaches to utilize this setup:
• API call to a trusted server to retrieve the signature (see Diagram 1 flow B). Here the unsigned data are
passed to the server via an API call and a signed string of this data is returned to the mobile APP. Then
a redirection via POSTing of the signature and unsigned data to the adyen MPP must follow.
• POSTing and Redirection to the MPP via trusted server. This flow includes a mapping of product and
customer to a unique id stored in a trusted server. Thus when a customer selects a product through an
app, he is redirected via POST or GET to the trusted server. There, the id of the product is extracted
and mapped to the product and corresponding amount which are then used for the HMAC calculation
along with other payment data. This procedure can be transparent to the Shopper, as the server
perform this calculations and automatically redirect to the MPP via POS after the calculations are
finished.
For more information on the HMAC calculation and use refer to the Adyen Integration Manual.
Copyright © Adyen B.V. 2011 9
