Create Checkout (Pre Auth)

*This is the recommended route for all new PreAuth integrations. It returns a consolidated checkout URL by Http POST + JSON, and is the only PreAuth entry point with a hosted card-entry form of our own. The older Pre Auth (Legacy) page (which renders a Share Commerce payment-options page and always redirects out to the acquirer for card payments) is now legacy - kept for existing integrations only, do not use it for new integrations.

This route has the SAME request fields and SAME signing convention as the legacy /PreAuth page (SCSign is a field inside the request body, NOT an HTTP header).


Staging URL: https://stagingpayment.share-commerce.com/CreateCheckout/PreAuth

Production URL: https://payment.share-commerce.com/CreateCheckout/PreAuth



Request (Json, Http POST only)

Same fields as PreAuth - refer there for the full field table. SCSign is computed the same way and is a field in the JSON body, not a header.


Request Sample

{
    "MerchantID": "MID00001",
    "CurrencyCode": "MYR",
    "PreAuthAmount": "101.50",
    "MerchantOrderNo": "POST0001",
    "MerchantOrderDesc": "perfume",
    "MerchantPaymentNo": "AHS917123",
    "MerchantRef1": "mref1",
    "MerchantRef2": "mref2",
    "MerchantRef3": "mref3",
    "CustReference": "ctRefIC111",
    "CustName": "TomTom",
    "CustEmail": "[email protected]",
    "CustPhoneNo": "01938668396",
    "CustAddress1": "add1",
    "CustAddress2": "add2",
    "CustCountryCode": "MY",
    "CustAddressState": "semenyih",
    "CustAddressCity": "selangor",
    "CustPostcode": "12345",
    "RedirectUrl": "https://www.shop.com",
    "PaymentMethod": "",
    "Versioning": 2,
    "SCSign": "f4f697675814787ecb52711b8f894e2ec8046c4f1588546cd7b590cf47511da8"
}

Response (Json)

*Note, RespCode here is an INTEGER (1 = Success, 9 = Failed) - it is NOT the same "00"/string response-code convention used by every other PreAuth response on this site (Refer to Appendix 1). Do not reuse Appendix 1 for this endpoint.


Field Name Data Type (Len) M/O Description
RespCode Integer M 1 = Success, 9 = Failed. NOT the Appendix 1 string codes used elsewhere.
RespMessage String O Error description. Only present when RespCode is not Success.
TxnRefNo String (50) M Unique reference of a transaction, generated by system.
CheckoutCode String M Checkout page identifier.
CheckoutUrl String M Consolidated checkout page url - redirect the customer here to complete payment.

Response Sample (Success)

{
    "RespCode": 1,
    "RespMessage": null,
    "TxnRefNo": "3262873184",
    "CheckoutCode": "34dbc85b-de3b-43e7-995c-50ecd16ad66a",
    "CheckoutUrl": "https://stagingpayment.share-commerce.com/Checkout/PreAuth/34dbc85b-de3b-43e7-995c-50ecd16ad66a"
}

Response Sample (Failed)

{
    "RespCode": 9,
    "RespMessage": "Invalid SCSign - expected HMAC-SHA256 of the signing string for this Versioning",
    "TxnRefNo": null,
    "CheckoutCode": null,
    "CheckoutUrl": null
}

*Note, this response is NOT signed - there is no SCSign on this call's response, in the body or in a header.



SCSign Calculation (Request)

Same convention as PreAuth: concat all request field values (in sequence), HMACSHA256 with the merchant's secret key, place the result in the request's own SCSign field.


Secret Key : mSuE3Ttn5B8vJhe5ncMutMLV


String to sign

MID00001MYR101.50POST0001perfumeAHS917123mref1mref2mref3ctRefIC111TomTomtomt@email.com01938668396add1add2MYsemenyihselangor12345https​://www.shop.com2

SCSign : f4f697675814787ecb52711b8f894e2ec8046c4f1588546cd7b590cf47511da8


Last updated on 22nd Sep 2026