<form method="post" action="https://onpay.io/window/v3/" accept-charset="UTF-8">
    <input type="hidden" name="onpay_gatewayid" value="20007895654">
    <input type="hidden" name="onpay_currency" value="DKK">
    <input type="hidden" name="onpay_amount" value="12000">
    <input type="hidden" name="onpay_reference" value="AF-847824">
    <input type="hidden" name="onpay_hmac_sha1" value="f31dc4b392c6a7a25815e3e2bc39bc0fe02cc5a7">
    <input type="hidden" name="onpay_accepturl" value="https://example.com/accept">
    <input type="submit" value="Start payment of 120.00 DKK">
</form>

<?php
$secret = 'e88ebc73104651e3c8ee9af666c19b0626c9ecacd7f8f857e3633e355776baad92e67b7faf9b87744f8c6ce4303978ed65b4165f29534118c882c0fd95f52d0c';

function calculateSecret(array $params, $secret) {
    // Step 1, grab the onpay_* params and order them alphabetically
    $toHashArray = [];
    foreach ($params as $key => $value) {
        if (0 === strpos($key, 'onpay_') && 'onpay_hmac_sha1' !== $key) {
            $toHashArray[$key] = $value;
        }
    }

    ksort($toHashArray);

    // Step 2, convert to a query string, and lower case
    $queryString = strtolower(http_build_query($toHashArray));
    // Output: onpay_accepturl=https%3a%2f%2fexample.com%2faccept&onpay_amount=12000&onpay_currency=dkk&onpay_gatewayid=20007895654&onpay_reference=af-847824

    // Step 3 calculate the SHA1 HMAC
    $hmac = hash_hmac('sha1', $queryString, $secret);

    return $hmac;
}

$formParams = [
    'onpay_gatewayid' => '20007895654',
    'onpay_currency' => 'DKK',
    'onpay_amount' => '12000',
    'onpay_reference' => 'AF-847824',
    'onpay_accepturl' => 'https://example.com/accept',
    'unrelated_param' => 'bla bla bla',
];

echo calculateSecret($formParams, $secret);
// Output: 16586ad0b3446b58df92446296cf821500ac57d8

var secret = "e88ebc73104651e3c8ee9af666c19b0626c9ecacd7f8f857e3633e355776baad92e67b7faf9b87744f8c6ce4303978ed65b4165f29534118c882c0fd95f52d0c";
var formParams = new Dictionary<string, string>
{
    {"onpay_gatewayid", "20007895654"},
    {"onpay_currency", "DKK"},
    {"onpay_amount", "12000"},
    {"onpay_reference", "AF-847824"},
    {"onpay_accepturl", "https://example.com/accept"},
    {"unrelated_param", "bla bla bla"}
};


// Step 1, grab the onpay_* params and order them alphabetically
var onpayParams = formParams
    .Where(x => x.Key.StartsWith("onpay_"))
    .Where(x => x.Key != "onpay_hmac_sha1")
    .OrderBy(x => x.Key)
    .ToArray();


// Step 2, convert to a query string, and lowercase the result
var queryString = string.Join("&", onpayParams.Select(x => HttpUtility.UrlEncode(x.Key) + "=" + HttpUtility.UrlEncode(x.Value))).ToLower();
// Output: onpay_accepturl=https%3a%2f%2fexample.com%2faccept&onpay_amount=12000&onpay_currency=dkk&onpay_gatewayid=20007895654&onpay_reference=af-847824

// Step 3 calculate the SHA1 HMAC
var hashString = "";
using (var sha1 = new HMACSHA1(Encoding.UTF8.GetBytes(secret)))
{
    var hash = sha1.ComputeHash(Encoding.UTF8.GetBytes(queryString));

    hashString = string.Join("", hash.Select(x => x.ToString("x2")));
    // Output: 16586ad0b3446b58df92446296cf821500ac57d8
}