Integrity Digest

The Integrity Digest lets you check that a payment result really came from Monek and hasn't been changed on the way, for example by a customer editing the query string on your SuccessUrl.

How it works

1. Send a secret. When your server creates the payment, through Prepared Payments or the Payments API, include an IntegritySecret that only you know.
2. Receive a digest. Monek uses your secret to create an IntegrityDigest from the key result fields, and returns it with the result.
3. Validate. Your server sends the result fields, the digest and your secret to IntegrityCheck.ashx. A 200 OK means the result is genuine.

warning

Only send IntegritySecret server to server, through Prepared Payments or the Payments API. A secret sent from a web page is ignored, and anyone could read it.

tip

If you use the same secret for every payment, rotate it regularly. You can also use a different secret for each payment.

Request field

Field Name	Description	Req'd	Size	Type
IntegritySecret	A secret known only to you, used to create the IntegrityDigest.	O	50 max.	A

Where the digest is returned

When you send an IntegritySecret, the result includes an IntegrityDigest field:

Field Name	Description	Size	Type
IntegrityDigest	A hash of key result fields, used to confirm the result is genuine and unmodified.	50 max.	A

It's returned with:

• the redirect to your SuccessUrl or FailureUrl, and HTMLQS and XML responses
• JSON responses
• Transact Webhooks

Webhooks sent through Svix are signed differently. Verify those with the Svix signature instead. See Webhooks.

Validating the Integrity Digest

Send a form-encoded HTTP POST to:

https://elite.monek.com/Secure/IntegrityCheck.ashx

Include these fields. Use the values from your original request and from the result exactly as you received them:

Field Name	Where to get it	Req'd	Size	Type
IntegritySecret	The secret you sent with the payment	M	50 max.	A
IntegrityDigest	The digest returned with the result	M	50 max.	A
RequestTime	The request time returned with the result. See the table below.	M	33 max.	ISO 8601
IdempotencyToken	The idempotency token you sent, if any	O	50 max.	A
PaymentReference	The payment reference you sent, if any	O	50 max.	A
CrossReference	The CrossReference returned with the result	M	50 max.	A
ResponseCode	The 2-digit ResponseCode returned with the result	M	2	N
ResponseMessage	The Message returned with the result	M	80 max.	A
Amount	The amount you sent, in pence	M	10 max.	N
CurrencyCode	The currency code you sent	M	3	N

Which time field to use

The digest is created from the time of the original request, which has a different field name depending on how you received the result:

How you received the result	Send this value as RequestTime
Redirect, HTMLQS or XML	RequestTime
JSON response	requestDateTime. Not transactionDateTime, which is the time of the response.
Transact Webhook	transactionDateTime

Example

POST /Secure/IntegrityCheck.ashx HTTP/1.1
Host: elite.monek.com
Content-Type: application/x-www-form-urlencoded

IntegritySecret=YOUR_SECRET&IntegrityDigest=RECEIVED_DIGEST&RequestTime=2026-11-04T10%3A11%3A12.4217561%2B00%3A00&PaymentReference=ORDER-0001&CrossReference=240401101112457459X2R&ResponseCode=00&ResponseMessage=AUTHCODE%3A457459&Amount=2500&CurrencyCode=826

Result

HTTP status	Meaning
200 OK	The digest matches. The result is genuine.
400 Bad Request	The digest doesn't match, or a required field is missing or wrong. Don't trust the result.
500 Internal Server Error	The check couldn't be completed. Try again before trusting the result.