Regarding: https://support.authorize.net/s/article/MD5-Hash-End-of-Life-Signature-Key-Replacement

Authorize.Net is phasing out the MD5 based hash use for transaction response verification in favor of the SHA-512 based hash utilizing a Signature Key. The end of life for MD5 Hash will be done in two phases: Phase 1 - Starting later this month to early February 2019, we will remove ability to configure or update MD5 Hash setting in the Merchant Interface. There are no changes to the existing API response.

Phase 2 - Stop sending the MD5 Hash data element in the API response. This change will require that applications support the SHA-512 hash via signature key. Dates for phase 2 will be announced later but is expected in the next 2-3 months.

When you receive a transaction response from Authorize.Net, it includes the a SHA2 hash element the name and position depend on the API integration method used. The SHA2 has field contains HMAC-SHA512 hash that Authorize.Net generated for the transaction.

Is CiviCRM's Authorize.net implementation affected?

  • Oops! I did search first, honest! :) Tried to close it as duplicate but apparently it needs more votes.
    – Laryn
    Commented Jan 24, 2019 at 20:53

1 Answer 1


There is a PR from Monish to remove md5 hash support from Authorize.net payment processor in CiviCRM. Its now merged in master branch and should be part of 5.11 release.



Not the answer you're looking for? Browse other questions tagged or ask your own question.