[Python] Redsys SIS0042 error (“Amount 0.00 Euros”) in Python/Flask 3DES integration...

I'm integrating the Redsys Virtual POS (redirect method) using a Python Flask backend and a React frontend. I’m correctly generating the HTML form and redirecting to Redsys, but I always get the following error screen:

❌ Technical error SIS0042
"Operation cannot be completed. Data error. Please contact your commerce."
Amount: 0.00 €


✅ What I’m doing

• 
  I build the Ds_MerchantParameters dictionary in JSON and base64-encode it.
  
  
• 
  I derive the HMAC key using Ds_Merchant_Order with 3DES in ECB mode.
  
  
• 
  I compute the HMAC-SHA256 signature over the base64 parameters.
  
  
• 
  I send an HTML form auto-submitted to:
  
  https://sis-t.redsys.es:25443/sis/realizarPago
  

Signature code (Python)

import base64, hmac, hashlib
from Crypto.Cipher import DES3
from Crypto.Util.Padding import pad

def derive_key(secret_key_base64: str, order_ref: str) -> bytes:
key = base64.b64decode(secret_key_base64) # 24 bytes
cipher = DES3.new(key, DES3.MODE_ECB)
return cipher.encrypt(pad(order_ref.encode(), 8)) # DES block size = 8

def generate_signature(secret_key_base64: str, order_ref: str, merchant_parameters_b64: str) -> str:
key_derived = derive_key(secret_key_base64, order_ref)
digest = hmac.new(key_derived, merchant_parameters_b64.encode(), hashlib.sha256).digest()
return base64.b64encode(digest).decode()


Example merchant parameters:

{
"Ds_Merchant_Amount": "40124",
"Ds_Merchant_Order": "123456789012",
"Ds_Merchant_MerchantCode": "355907924",
"Ds_Merchant_Currency": "978",
"Ds_Merchant_TransactionType": "0",
"Ds_Merchant_Terminal": "1",
"Ds_Merchant_MerchantURL": "https://myapp.com/api/redsys/notify",
"Ds_Merchant_UrlOK": "https://myapp.com/checkout-success",
"Ds_Merchant_UrlKO": "https://myapp.com/checkout-error"
}


Form generated and sent to Redsys

<form id="redsysForm" action="https://sis-t.redsys.es:25443/sis/realizarPago" method="POST">
<input type="hidden" name="Ds_SignatureVersion" value="HMAC_SHA256_V1" />
<input type="hidden" name="Ds_MerchantParameters" value="eyJEc..." />
<input type="hidden" name="Ds_Signature" value="H2fU..." />
</form>
<script>document.getElementById('redsysForm').submit();</script>


✅ Things I’ve checked

• ✅ Ds_Merchant_Order is exactly 12 characters long and starts with digits.
• ✅ Amount is in cents ("40124" means €401.24).
• ✅ The base64 of Ds_MerchantParameters decodes into valid JSON.
• ✅ Signature uses HMAC-SHA256 + derived 3DES key from the order ref.
• ✅ Base64 signature is not truncated, padding (=) is preserved.
• ✅ 3DES padding is 8-byte aligned (not AES-128).

❌ Still getting SIS0042 + “Amount 0.00 €”


❓My questions

• Could Redsys be rejecting my JSON silently, even though it’s valid?
• Is the Ds_Merchant_Amount possibly being ignored because of signature mismatch?
• Is there any way to debug this before submission (e.g., test mode response parsing)?

Thanks

I've read the official docs and compared with working PHP and Java samples. I'm stuck and would greatly appreciate help.

Continue reading...