Secure QR Payload (Java)

An example of generating a Secure QR Payload signature and building the QR URL in Java (server-side only — keep the validation key in a secure config / environment variable).

import javax.crypto.Mac;
import javax.crypto.spec.SecretKeySpec;
import java.nio.charset.StandardCharsets;

public static String generateSignature(String key, int amount, String id) throws Exception {
    String message = key + "||" + amount + "||" + id;
    Mac mac = Mac.getInstance("HmacSHA256");
    mac.init(new SecretKeySpec(key.getBytes(StandardCharsets.UTF_8), "HmacSHA256"));
    byte[] hash = mac.doFinal(message.getBytes(StandardCharsets.UTF_8));
    StringBuilder hex = new StringBuilder();
    for (byte b : hash) hex.append(String.format("%02x", b));
    return hex.toString();
}

String key      = "my-validation-key";
String id       = "ORDER-001";
int    amount   = 10050;
String snapcode = "mymerchant";

String signature = generateSignature(key, amount, id);
String qrUrl     = "https://pos.snapscan.io/qr/" + snapcode
                 + "?id=" + id + "&amount=" + amount + "&signature=" + signature;