Skip to content
Search Articles/

less than a minute read • Updated 5 days ago

HMAC excluded parameters reference

A reference for parameters exempt from HMAC signing — cart options, checkout pre-population fields, and the h:, x:, and utm_ name prefixes.

When HMAC validation is enabled, most product parameters must be signed. The following parameters are exempt — signing them is unnecessary and may cause errors.

Cart options

Parameter

Description

cart

Cart action (e.g. checkout, add)

fcsid

Session ID

empty

Empties the cart

coupon

Coupon code

output

Output format (e.g. json)

sub_token

Subscription token

redirect

Redirect URL after add to cart

callback

JSONP callback

_

Cache-busting parameter

locale

Locale override

template_set

Template set override

Checkout prepopulation

Parameter

customer_email

billing_first_name

billing_last_name

billing_address1

billing_address2

billing_city

billing_state

billing_postal_code

billing_country

billing_phone

billing_company

shipping_first_name

shipping_last_name

shipping_address1

shipping_address2

shipping_city

shipping_state

shipping_region

shipping_postal_code

shipping_country

shipping_phone

shipping_company

Name prefixes

Parameters using the following name prefixes are also exempt:

Prefix

Description

h:

Session variables — visible server-side only, not in the cart

x:

Excluded variables — passed through to the datafeed but ignored by the cart

__

Double underscore — internal use

utm_

Google campaign tracking parameters

Need Help?

Did this article answer your questions? Need help with anything? Please click below to contact us.