Operation hash

operationHashis the brand's correlation key. It is stored with signed operations and emitted in completed issuance/redemption events, so your backend can connect a Loyfin receipt to an internal Add to wallet, Add from wallet, campaign, or support record.

• Use a cryptographically random 32-byte value and store its mapping to the internal operation, or derive 32 bytes with HMAC-SHA-256 under a server-side secret.
• Do not publish a plain hash of a low-entropy internal ID such as keccak256("issuer:conversion:12345"); an observer can guess likely IDs and brute-force the mapping.
• Do not put raw customer IDs, order IDs, emails, CRM IDs, or secret material onchain.
• Store both the raw internal ID and the resulting operationHash in your own database.
• Use 0x000...000 only for tests or operations that truly do not need reconciliation.

After creating an issuance or redemption session, use account-level webhooks as the default completion signal and poll GET /operations/:id as a fallback. For completed receipts, query GET /issuances?operationHash=... or GET /redemptions?operationHash=.... For Add from wallet reconciliation, brands can also query GET /redemptions?from=...&token=...&chainId=8453. The same hash should appear in your internal row, the stored signed operation, and the mined event receipt.