2CO has our own proprietary set of parameters that you can use if your cart supports them. If you would like to test your integration of these parameters, try using our developers.2Checkout area.

Multi-page Payment Routine:
https://www.2checkout.com/checkout/purchase
Supports all payment methods. Supports tangible and intangible products/services.

Single Page Payment Routine:
https://www.2checkout.com/checkout/spurchase
Only supports credit card payments and intangible products/services.

Required Parameters:
sid – Your 2Checkout vendor account number.
total – The total amount to be billed, in decimal form, without a currency symbol. (8 characters, decimal, 2 characters: Example: 99999999.99)
cart_order_id – A unique order id from your program. (128 characters max)

Product Identification Parameters:
Suppliers using this parameter set must pass in parameters to identify what is being sold during the purchase. These parameters will also benefit suppliers as when used correctly the product information will be displayed to customers on the purchase pages and will be listed on the suppliers 2Checkout.com sale detail page.

id_type – Due to changes in with the Product Identification parameters this parameter should be passed in once during the purchase and will need to have its value set to 1.
c_prod – The ID of the product that is being purchased. The quantity of product being purchased can passed with this parameter by placing a comma after the ID and then the quantity in numeric format.
c_name – The value of this parameter should contain the name of the product to be created. (128 characters max)
c_description – The value of this parameter should contain a short description of the product to be sold. (255 characters max)
c_price – The price of your product. Please note that in order to prevent a discrepancy between the total parameter and the sum of the product identification c_price parameters which may confuse the customer, the product price will not be displayed on the purchase page. (8 characters, decimal, 2 characters: Example: 99999999.99)

You can use these identification parameters to pass in multiple products as well. To do so you will need to append a digit to each parameter. For example, c_prod_1, c_name_1, c_description_1, c_price_1 will describe the first product, then to describe the second product you would use a 2 so the parameters will read c_prod_2, c_name_2 and so on.

Additional Parameters:
demo – Y to enable demo mode. Do not pass for live sales. Can also be controlled within the account.
lang – Chinese – zh, Danish – da, Dutch – nl, French – fr, German – gr, Greek – el, Italian – it, Japanese – jp, Norwegian – no, Portuguese – pt, Slovenian – sl, Spanish – es_ib, Spanish – es_la, Swedish – sv, defaults to English if this is absent, but en may be used for English as well.
merchant_order_id – Specify your order number with this parameter. It will also be included in the confirmation emails to yourself and the customer. (50 characters max)
pay_method – CC for Credit Card, CK for check, AL for Acculynk PIN-debit, PPI for PayPal, or PPL for PayPal Pay Later. This will set the default selection on the payment method step during the checkout process.
skip_landing – If set to 1 it will skip the order review page of the purchase routine.
x_Receipt_Link_URL – Used to specify an approved URL on-the-fly, but is limited to the same domain that is used for your 2Checkout account, otherwise it will fail. This parameter will over-ride any URL set on the Look and Feel page. (no limit)

To pre populate the billing information page you may pass in:
card_holder_name – Card holder’s name (128 characters max)

The card holder’s name can also be populated using the first_name, middle_initial, and last_name parameters. IMPORTANT: If you use these three parameters, the data will be combined into and returned as card_holder_name to your Approved URL script.

street_address – Card holder’s street address(64 characters max)
street_address2 – The second line for the street address, typically suburb or apartment number information (64 characters max)
city – Card holder’s city (64 characters max)
state – Card holder’s state (64 characters max)
zip – Card holder’s zip (16 characters max)
country – Card holder’s country (64 characters max)
email – Card holder’s email (64 characters max)
phone – Card holder’s phone (16 characters max)
phone_extension – Card holder’s phone extension (9 characters max)

To pre populate the shipping information page you may pass in:
ship_name
ship_street_address
ship_street_address2
ship_city
ship_state
ship_zip
ship_country

Please note that shipping information will only be collected for items that are defined as tangible in our system. Shipping is also only charged for tangible items.

The billing information page will also be populated with the information from the shipping page if the shipping information is collected on that sale and the billing information is not passed in.

Custom Parameters:
You may pass in any additional parameters that you may need and they will be returned to you at the end of the sale. The only restrictions on custom parameters are that they can not share the name of ANY parameter that our system uses, even from the other sets. Please note that you WILL need a return script set up on the Look and Feel page to receive any of these parameters back as they are not included in the confirmation emails.

You can receive back all of the parameters that were passed in as well as the following parameters:
order_number – 2Checkout.com order number
cart_order_id – Your cart ID number passed in.
credit_card_processed – Y if successful (Approved).
key – the MD5 hash used to verify that the sale came from one of our servers

Consult the documentation that came with your cart or contact the cart manufacturer for assistance with setting this up or to determine what URL you should enter on the Look and Feel page for your cart to receive the product information.

Recurring billing can not be done with this parameter set. You must use the Plug-N-Play parameter set and have the products defined within the 2CO database for recurring billing.

Important: You can not mix the three parameter sets. This will cause problems during payment or may prevent the payment pages from working at all.

Important Note: When you are testing parameters, please be certain to clear the cookies in your browser between tests to ensure the changes you have made are applied. For more information on clearing the cookies please click here.

Related Article: Country Codes

This parameter is used to verify the passbacks for you. Depending on what parameter set you are using, this will either appear as ‘key’ or ‘x_MD5_Hash‘. The MD5 hash is also provided to help you verify the authenticity of INS posts. On INS posts the hash is returned in the md5_hash parameter.

One of the Md5 hash components involves a secret word that can be set by you. To set it, follow these directions:

Setting Your Secret Word:

1. Login to your account.
2. Click on “Look and Feel” found on your account homepage.
3. Enter your secret word into the data field labeled, “Your Secret Word (16 Character Limit)”. As labeled, the only limit is that it must be 16 characters or less.
4. Click “Save Changes” when you are finished.

Please read the related article below for more information about the MD5 Specifications.
How do I use the MD5 Hash?

The MD5 hash is provided to help you verify the authenticity of a sale. This is especially useful for vendors that sell downloadable products, or e-goods, as it can be used to verify whether sale actually came from 2Checkout and was a legitimate live sale. We intentionally break the hash code for demo orders so that you can compare the hash we provide with what it should be to determine whether or not to provide the customer with your goods.

To calculate the MD5 hash, you need to make a string that contains the information described below and pass it in as the value to your scripting languages MD5 function. Below is an example:

md5 ( secret word + vendor number + order number + total )

The secret word is set by yourself on the Site Managment page. The vendor number is your numerical vendor/seller ID number. The order number is the order number for the sale. The total is the numerical value for the total amount of the sale.

Demonstration:

Secret Word => tango
Vendor Number => 123456
Order Number => 9999999
Total => 5.99

md5hash = md5( tango12345699999995.99 )

It is important to note that the MD5 hash must also be converted to upper case letters for a clean comparison. How this is done depends on the scripting language that you use. Below are some examples of how to compute the MD5 hash using PHP. This should illustrate how this process works.

The following code would be applicable to orders placed using our Plug and Play cart and our proprietary third party set of parameters.

$string_to_hash = “tango123456″ . $_POST["order_number"]
.
$_POST["total"];
$check_key = strtoupper(md5($string_to_hash));

echo (”Returned MD5 Hash : ” . $_POST["key"]
. “<BR>”);
echo (”Should be : ” . $check_key . “<BR>”);

if($check_key == $_POST["key"]){
// At this point the expected key and the returned key match, so the customer should be given access to the download
// This is where you would want to put the code or page for the download
echo (”<center>They match!</center>”); }
else {
// At this point the keys do not match, so either the attempt was fraudulent or a demo order
// This is where you would put the code or page for an unsuccessful attempt
echo (”<center>They do NOT match! Was this a demo order?</center>”);}

The following code would then be applicable to orders placed using the Authorize.net
parameter set.

$string_to_hash = “tango123456″ . $_POST["x_trans_id"]
.
$_POST["x_amount"];
$check_key = strtoupper(md5($string_to_hash));

echo (”Returned MD5 Hash : ” . $_POST["x_MD5_Hash"]
. “<BR>”);
echo (”Should be : ” . $check_key . “<BR>”);

if($check_key == $_POST["x_MD5_Hash"]){
// At this point the expected key and the returned key match, so the customer
should be given access to the download
// This is where you would want to put the code or page for the download
echo (”<center>They match!</center>”); }
else {
// At this point the keys do not match, so either the attempt was fraudulent
or a demo order
// This is where you would put the code or page for an unsuccessful attempt echo (”<center>They do NOT match! Was this a demo order?</center>”);}

The MD5 hash is also provided to help you verify the authenticity of INS posts. The MD5 hash that is sent with INS posts is a hash of sale_id + vendor_id + invoice_id + secret word in the md5_hash parameter.

Demonstration:

sale_id => 9999999999
vendor_id => 123456
invoice_id => 1111111111
Secret Word => tango
md5hash = md5( 99999999991234561111111111tango )

The following code would be applicable to orders placed using our Plug and Play cart and our proprietary third party set of parameters.

$string_to_hash = $_POST[“sale_id”] . “123456” . $_POST[“invoice_id”] . “tango”;
$check_key = strtoupper(md5($string_to_hash));
echo (“Returned MD5 Hash : ” . $_POST[“md5_hash”]
. “
”);
echo (“Should be : ” . $check_key . “
”);
if($check_key == strtoupper($_POST[“md5_hash”])){
// If the expected key and the returned key match the authenticity of the message has been validated.
echo (”They match!”); }
else {
// At this point the keys do not match.
// This is where you would put the code for an unsuccessful attempt.
echo (“They do NOT match!”);}

Please note that help with implementing the MD5 hash into your return script is beyond the realm of 2Checkout.com’s support. This document is provided merely as a reference document to help point you in the right direction. How the MD5 hash is computed is dependent upon the scripting language that you use. Implementation of any MD5 hash checking is solely on your end or your server. 2Checkout.com can not provide you with support in implementing this or troubleshooting your implementation. We provide you with the hashes as a convenience to help you protect your digital goods.

The following links may be of interest to you if you are looking for more information on the MD5 algorithm and its use.

http://userpages.umbc.edu/~mabzug1/cs/md5/md5.html
http://en.wikipedia.org/wiki/MD5
http://msdn.microsoft.com/library/en-us/cpref/html/frlrfSystemSecurityPolicyHashClassMD5Topic.asp

We have also intentionally designed the MD5 hash not to work for demo sales as was explained earlier. If the sale is in demo mode, the order number used to create the hash will be forced to a one, which will cause the hashes to be different when you compare them. If you wish to test the hashes, you’ll have to place a live test order using a real credit card number.