// incl/dwollaKeys.php
<?php

// Dwolla Secret Stuff
$dwollaKey = 'eSEV37L/3VTMZpK4rmbC7y/HNUg+V9fUgwKoJrADYF41dDmvDj';
$dwollaSecret = 'sObX/aXpL4LAAeb1MjpEzwX1R3y6nNSNrIZfU1bpwcYfbAPRIJ';

//form.php
//accid = orderId
    require "incl/dwollaKeys.php";

    $unixtime = time();
    $accid = '2512';

    echo '<div class="dwolla">
        <form accept-charset="UTF-8" action="https://uat.dwolla.com/payment/pay" method="post">
                <input id="key" name="key" type="hidden" value="'.$dwollaKey.'" />
                <input id="signature" name="signature" type="hidden" value="'.hash_hmac('sha1', "{$dwollaKey}&{$unixtime}&{$accid}", $dwollaSecret).'" />
                <input id="callback" name="callback" type="hidden" value="'.basename($_SERVER['PHP_SELF']).'/notificationsDwolla.php" />
                <input id="redirect" name="redirect" type="hidden" value="'.$_SERVER['PHP_SELF'].'?thanks" />
                <!--<input id="test" name="test" type="hidden" value="true" />-->
                <input id="description" name="description" type="hidden" value="Amount will be credited to your account" />
                <input id="destinationid" name="destinationid" type="hidden" value="812-166-7117" />
                <div class="ui-corner-all ui-button">
                    USD: $<input id="amount" name="amount" type="number" placeholder="Amount in USD" maxlength="10" min="1.00" step="1.00" />
                </div>
                <input id="allowFundingSources" name="allowFundingSources" type="hidden" value="true" />
                <input id="orderid" name="orderid" type="hidden" value="'.$accid.'" />
                <input id="timestamp" name="timestamp" type="hidden" value="'.$unixtime.'" />
                <button type="submit" name="submit" alt="Checkout with Dwolla.">Checkout with Dwolla</button>
        </form>
    </div>';

//notificationsDwolla.php
    require "incl/dwollaKeys.php";

    function verifyGatewaySignature($proposedSignature, $checkoutId, $amount) {
        $amount = number_format($amount, 2);
        $signature = hash_hmac('sha1', "{$checkoutId}&{$amount}", $dwollaSecret);
        return $signature == $proposedSignature;
    }

    $data = json_decode(file_get_contents('php://input'));

    $sigantureValid = verifyGatewaySignature($data->Signature, $data->CheckoutId, $data->Amount);

    $debugFile = "debugDwolla.log";
    $fh = fopen($debugFile, 'a') or die("can't open file");
    $stringData = json_encode($data)."\n";
    fwrite($fh, $stringData);
    $stringData = $sigantureValid ? 'true' : 'false' .", ".$data->Signature.", ".$data->CheckoutId.", ".$data->Amount."\n";
    fwrite($fh, $stringData);
    fclose($fh);

    if( $sigantureValid ){
        //do thing when it's validated
    } else {
        echo 'Signature not valid';
    }