“Invalid Signature” Error in eSewa: 5 Causes and Exact Fixes (2026 Developer Guide)

When eSewa's gateway displays **"Invalid Signature"**, it means the `signature` parameter in your form submission does not match the HMAC-SHA256 hash eSewa calculated on their server. Here are the 5 exact causes: ### 1. Wrong Concatenation Order in signed_field_names eSewa calculates the signature strictly over the fields listed in `signed_field_names`. The standard v2 fields are: `total_amount,transaction_uuid,product_code`. Your string **must** look like: `total_amount=100.00,transaction_uuid=123-abc,product_code=EPAYTEST` If you swap the order or add extra spaces, the signature is invalid. ### 2. Float and Decimal Number Formatting Bug If your form sends `total_amount: 100`, but your hash was generated with `100.00` (or vice versa), the hashes differ. Always normalize the string representation in both the hash and form payload. ### 3. Binary vs. Hex Output in hash_hmac In PHP, `hash_hmac('sha256', $data, $key, true)` must have the 4th parameter set to `true` (raw binary) before passing to `base64_encode()`. If you omit `true`, it outputs hex string, resulting in an invalid signature. ### 4. Whitespace or Quotes in Secret Key A trailing newline or carriage return (`\r\n`) in your `.env` file when copying `8gBm/:&EnhH.1/q` will corrupt the key. Always run `trim()` on environment variables. ### 5. Encoding Mismatches in Success Callback In the return URL, eSewa passes base64 encoded JSON in the `data` parameter. If you attempt to verify the return signature against individual query parameters instead of the decoded payload, verification fails.

Use these tested helper functions to generate 100% valid signatures:

const crypto = require("crypto");

function generateEsewaSignature(secretKey, totalAmount, transactionUuid, productCode) {
  // 1. Format totalAmount consistently
  const formattedAmount = Number(totalAmount).toFixed(2);
  
  // 2. Build exact concatenation string
  const dataToSign = `total_amount=${formattedAmount},transaction_uuid=${transactionUuid},product_code=${productCode}`;
  
  // 3. Generate raw binary HMAC-SHA256 and convert to base64
  const hmac = crypto.createHmac("sha256", secretKey.trim());
  hmac.update(dataToSign);
  const signature = hmac.digest("base64");
  
  return { signature, formattedAmount, dataToSign };
}

// Test with eSewa Sandbox values
const { signature, dataToSign } = generateEsewaSignature(
  "8gBm/:&EnhH.1/q",
  100,
  "241018-001",
  "EPAYTEST"
);
console.log("Input:", dataToSign);
console.log("Valid Signature:", signature);