Common integration mistakes
The signature does not match, though it is “the same as for payments”
Subscriptions use a different scheme. Callisto computes the signature with two HMAC passes (login + inner); here there is one: the key is SecretKey, the message is SubscriptionProjectID + Now. The login is not part of the signature at all, and subscriptions have their own secret, separate from the one used for one-time payments.
| Cause | How to check |
|---|---|
| The Callisto formula was used | Subscriptions use one HMAC pass, not two, and no login |
| Local time instead of UTC | Now is always UTC in yyyyMMddHHmmss format |
One Now signed, another sent | Compute the timestamp once and use it both in the signature and in the body |
| Wrong secret | Subscriptions have their own secret, separate from the one-time payments one |
ApproveSubscription returns ExceededSubscriptionApprovingAttempts
Three PIN attempts are allowed. After the third failure the subscription stays in ApprovingFailed forever: the correct PIN will not revive it, you need a new CreateSubscription. The same answer comes if the subscription was not confirmed within 3 hours.
Creating a subscription again for the same number returns SubscriptionAlreadyCreated
A subscription is unique per project + Subscriber_MSISDN: while the previous one is not cancelled, a repeated CreateSubscription is rejected — production behaves the same way. The SubscriptionID of the existing subscription is printed in ErrorDescription so you can continue the scenario. To run it from scratch, use another number or call CancelSubscription first.
No callback after a card payment
Check that the subscriber reached the end of the AuthorizeUrl page: the subscription is activated by the completed payment, not by opening the link. The link is single-use and lives for 15 minutes. If the card ended with 0001…0005, the payment was declined on purpose — an EventType=REJECTED callback arrives.
The method returns a parsing error
The method name is passed in the path and is case-insensitive, but it must be one of the five supported ones (see “Methods”). The body is either XML or application/x-www-form-urlencoded; with Content-Type: text/xml an empty body or unparsable XML gives WRONG_PARAMS.