PayFast passphrase mismatch
The salt passphrase is a secret you choose in PayFast. PayFast adds it to the end of every signature it creates, and your store adds it when it checks the signature. If the two values are not identical, every payment notification fails with a signature error and orders stay pending.
Where to set it
- Live account: PayFast dashboard, Settings, field Salt Passphrase.
- Sandbox: log in at sandbox.payfast.co.za with your own sandbox account and set Salt Passphrase in the account settings. The sandbox and live passphrases are separate.
Then paste the same value into your WooCommerce PayFast plugin, in the passphrase field for the same mode.
When the passphrase is required
PayFast's developer docs say a passphrase is required for:
- Subscriptions (recurring billing), including WooCommerce Subscriptions through PayFast;
- Tokenization payments;
- the PayFast API, which plugins use for refunds from the WooCommerce order screen.
For plain once-off payments it is optional, but setting one is recommended because it makes a forged notification much harder.
Checklist when it still mismatches
- Reset the passphrase in PayFast instead of trusting the old one. Type a new one without spaces, save it.
- Paste it into the plugin and save. Check there is no leading or trailing space.
- Make sure you edited the right mode. Many plugins keep separate sandbox and live fields.
- Place a new test order. Old notifications were signed with the old passphrase and will still fail.
- If it still fails with a passphrase you are sure of, the plugin may build the signature string wrongly. See PayFast ITN invalid signature.
Our plugin
Skillmerc Payment Gateway for PayFast (free on WordPress.org) has separate sandbox and live passphrase fields, so switching modes never means retyping keys, and its debug log shows each notification received followed by the reason it was rejected. Independent, not made by PayFast.