V3 signed redirect (frozen, deprecated)

Existing V3 web-checkout integrations continue to work against https://v4pay.pokeapay.com/checkout with the documented parameters and the legacy hash — byte-for-byte compatible:

// V3 legacy checkout hash (frozen — do not use for new builds)
$message = $live . $oref . $amt . $tel . $eml . $cc;
$hash    = hash_hmac('sha1', $message, $secretKey);
ParamMeaning
live"1" live / "0" demo (V3 semantics; V4 credentials derive this instead)
orefYour order reference
amtAmount as a decimal string (V3 semantics)
telCustomer phone
emlCustomer email
ccCustomer/merchant code
hashThe HMAC-SHA1 above

SHA-1 is deprecated. This surface is retained only so existing links keep working during the V3 deprecation window and will not be extended. New integrations must use the V4 hash or payment links. See the deprecation schedule.