> For the complete documentation index, see [llms.txt](https://docs.kitegateway.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.kitegateway.com/receiving-money/merchant-redirect.md).

# Merchant Redirect

### The structure

At our end, we append the redirect parameters to the URL that's set in the initial collection request by you. The final redirect URL would look like the following;

```http
https://redirect_url?id=&merchant_reference=&kitegateway_reference=&status=&message=&signature=
```

{% hint style="danger" %}

#### redirect\_url

It must be secured by **SSL.** ie, it must start with **https\://**
{% endhint %}

Description of the query parameters that we append

| Parameter              | Type   | Description                                                                                                                                                                                                                                                                                                                                                                                     |
| ---------------------- | ------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| id                     | string | The transaction ID of the transaction                                                                                                                                                                                                                                                                                                                                                           |
| merchant\_reference    | string | Your generated merchant transaction id for the transaction                                                                                                                                                                                                                                                                                                                                      |
| kitegateway\_reference | string | The Kitegateway payment reference of the transaction                                                                                                                                                                                                                                                                                                                                            |
| status                 | string | <p>The <a href="/pages/-MaF_pn4Gj5TUcr64FrZ">transaction status</a>. Values can be one of; </p><p><strong>PENDING -</strong> When a payment is in the queue for processing, <strong>CANCELLED -</strong> If a customer cancels a payment, </p><p><strong>FAILED</strong> - When a payment fails for some reason</p><p><strong>COMPLETED -</strong> When a payment is successfully completed</p> |
| message                | string | Information describing the status of the transaction                                                                                                                                                                                                                                                                                                                                            |
| signature              | string | The RSA signature generated by **Kitegateway**. This can optionally be verified by the merchant to ensure that the redirect comes from **Kitegateway** before providing service to the customer                                                                                                                                                                                                 |

{% hint style="warning" %}
&#x20;1\. We strongly recommend you check for the availability of these parameters in the    URL and also confirm that the references correspond to the data available in your application.&#x20;

2\. Further we assert that you should verify the signature so that you are sure that the request is coming from our servers. This way the legitimacy of the redirect is affirmed.
{% endhint %}

### How to verify redirect signature (Optional)

This section describes the steps taken to verify the signature using sample query parameters. Assume that the redirect URL is as follows;&#x20;

```http
https://your.redirecturl?id=8828827777762662662662&merchant_reference=merc-19928288-282772&kitegateway_reference=PL4889KJSuSUUSH&status=COMPLETED&message=Transaction%20Completed%20Successfully&signature=c0K46co6bmQkoDW8XjEWQ7nBAteBo5
```

1. Form the string payload to be used in the signature verification. This is obtained by concatenating values of the redirect data in the format; `id:merchant_reference:kitegateway_reference:status:redirect_url` where redirect\_url is the value you specified for the **redirect\_url** parameter when making the initial collection request.
2. The string payload in our example would therefore be the following;

```bash
2888377377379926:MERC-6778J-KL8UN:PL377399-KTHHSH-888766:COMPLETED:https://your-redirecturl
```

3\. Download the public key as described [here](/receiving-money/direct-card-payment.md#2-downloading-public-key).

4\. Use the public key to verify the signature as described in the sample source code below

{% tabs %}
{% tab title="JavaScript" %}

```javascript
const crypto = require('crypto');
const fs = require('fs');

function isSignatureValid() {
    const strPayload = "2888377377379926:MERC-6778J-KL8UN:PL377399-KTHHSH-888766:COMPLETED:https://your-redirecturl";
    const signature = "signature-from-query-params";
    const publicKeyFile = "path-to-file/kitegateway.public.key.pem";
    const publicKey = fs.readFileSync(publicKeyFile).toString().replace(/\\n/g, '\n');

    const verify = crypto.createVerify("SHA512");
    verify.write(strPayload);
    verify.end();

    // true or false
    return verify.verify(publicKey, signature, 'base64');
}
```

{% endtab %}

{% tab title="PHP" %}

```php
<?php
public function isSignatureValid() {
    $file = "path-to-file/kitegateway.public.key.pem";
    $keyContent = file_get_contents($file);
    $publicKey = openssl_get_publickey($keyContent);
    $strPayload = "2888377377379926:MERC-6778J-KL8UN:PL377399-KTHHSH-888766:COMPLETED:https://your-redirecturl";
    $signature = base64_decode("signature-from-query-params");

    // true or false
    return openssl_verify($strPayload, $signature, $publicKey, OPENSSL_ALGO_SHA512) == 1;
}

?>
```

{% endtab %}
{% endtabs %}