Error with pagseguro

I have a small error that I can not understand ... in my view, everything is ok. plus the payback returns error.

53091 sender hash invalid.

index.php

<script type="text/javascript" src="https://code.jquery.com/jquery-2.2.4.min.js"></script><scripttype="text/javascript">

    $(document).ready(function() {

                $.ajax({
                    url : 'pg.php',
                    type : 'post',
                    dataTyp : 'json',
                    async : false,
                    timeout: 20000,
                    success: function(data){
                                    console.log(data);
                    }
                });

    });
</script>

pg.php

<?php
echo $idSessao = iniciaPagamentoAction();
function iniciaPagamentoAction() { //gera o código de sessão obrigatório para gerar identificador (hash)


        $data['token'] ='token.gerado.pelo.pagseguro';


        $emailPagseguro = '[email protected]';

        $data = http_build_query($data);
        $url = 'https://ws.sandbox.pagseguro.uol.com.br/v2/sessions';

        $curl = curl_init();

        $headers = array('Content-Type: application/x-www-form-urlencoded; charset=ISO-8859-1'
            );

        curl_setopt($curl, CURLOPT_URL, $url . "?email=" . $emailPagseguro);
        curl_setopt($curl, CURLOPT_POST, true);
        curl_setopt( $curl,CURLOPT_HTTPHEADER, $headers );
        curl_setopt( $curl,CURLOPT_RETURNTRANSFER, true );
        curl_setopt($curl, CURLOPT_SSL_VERIFYPEER, false);
        curl_setopt($curl, CURLOPT_POSTFIELDS, $data);
        //curl_setopt($curl, CURLOPT_HTTP_VERSION, CURL_HTTP_VERSION_1_1);
        curl_setopt($curl, CURLOPT_HEADER, false);
        $xml = curl_exec($curl);

        curl_close($curl);

        $xml= simplexml_load_string($xml);
        $idSessao = $xml -> id;
        return $idSessao;

    }

 print_R(efetuaPagamentoBoleto($idSessao));


    function efetuaPagamentoBoleto($dados) {

$data['hash'] = $dados;
$data['paymentMode'] = 'default';
$data['paymentMethod'] = 'boleto';
$data['receiverEmail'] = '[email protected]';
$data['currency'] = 'BRL';
$data['extraAmount'] = '1.00';
$data['itemId1'] = '0001';
$data['itemDescription1'] = 'Notebook Prata';
$data['itemAmount1'] = '24300.00';
$data['itemQuantity1'] = '1';
$data['notificationURL'] = 'https://sualoja.com.br/notifica.html';
$data['reference'] = 'REF1234';
$data['senderName'] = 'Jose Comprador';
$data['senderCPF'] = '22111944785';
$data['senderAreaCode'] = '11';
$data['senderPhone'] = '56273440';
$data['senderEmail'] = '[email protected]';
$data['senderHash'] = 'abc123';
$data['shippingAddressStreet'] = 'Av. Brig. Faria Lima';
$data['shippingAddressNumber'] = '1384';
$data['shippingAddressComplement'] = '5o andar';
$data['shippingAddressDistrict'] = 'Jardim Paulistano';
$data['shippingAddressPostalCode'] = '01452002';
$data['shippingAddressCity'] = 'Sao Paulo';
$data['shippingAddressState'] = 'SP';
$data['shippingAddressCountry'] = 'BRA';
$data['shippingType'] = '1';
$data['shippingCost'] = '1.00';

        $emailPagseguro = "[email protected]";
        $tok = 'FD0E162394DF4E1CB28BCC4A2C9B3A17';
        $data = http_build_query($data);
        $url = 'https://ws.sandbox.pagseguro.uol.com.br/v2/transactions'; //URL de teste


        $curl = curl_init();

        $headers = array('Content-Type: application/x-www-form-urlencoded; charset=ISO-8859-1'
            );

        curl_setopt($curl, CURLOPT_URL, $url . "?email=" . $emailPagseguro . "&token=" . $tok);
        curl_setopt($curl, CURLOPT_POST, true);
        curl_setopt( $curl,CURLOPT_HTTPHEADER, $headers );
        curl_setopt( $curl,CURLOPT_RETURNTRANSFER, true );
        curl_setopt($curl, CURLOPT_SSL_VERIFYPEER, false);
        curl_setopt($curl, CURLOPT_POSTFIELDS, $data);
        //curl_setopt($curl, CURLOPT_HTTP_VERSION, CURL_HTTP_VERSION_1_1);
        curl_setopt($curl, CURLOPT_HEADER, false);
        $xml = curl_exec($curl);

        curl_close($curl);

        $xml= simplexml_load_string($xml);


        //echo $xml -> paymentLink;
        $boletoLink =  $xml -> paymentLink;
        $code =  $xml -> code;
        $date =  $xml -> date;

        //aqui eu ja trato o xml e pego o dado que eu quero, vc pode dar um var_dump no $xml e ver qual dado quer

        $retornoBoleto = array(
                'paymentLink' => $boletoLink,
                'date' => $date,
                'code' => $code
        );

        return $retornoBoleto;

    }
?>

payoff response:

Creating the session - > 09/07/18 23:13:27 POST / v2 / sessions View log 200

host: ws.sandbox.pagseguro.uol.com.br
accept: */*
content-type: application/x-www-form-urlencoded; charset=ISO-8859-1
accept-encoding: gzip
connection: Keep-Alive


200
Content-Type: application/xml;charset="ISO-8859-1"
<?xml version="1.0" encoding="ISO-8859-1" standalone="yes"?><session><id>b4575bb6a72042038e8926b41add4d23</id></session>

Performing transaction - > 09/07/18 23:13:28 POST / v2 / transactions View log 400

Parametros
reference:REF1234
shippingAddressCity:Sao Paulo
shippingAddressStreet:Av. Brig. Faria Lima
senderAreaCode:11
shippingAddressState:SP
notificationURL:https://sualoja.com.br/notifica.html
senderEmail:[email protected]
extraAmount:1.00
shippingType:1
senderCPF:22111944785
hash[0]:b4575bb6a72042038e8926b41add4d23
shippingCost:1.00
senderHash:abc123
itemQuantity1:1
itemAmount1:24300.00
paymentMode:default
shippingAddressNumber:1384
paymentMethod:boleto
shippingAddressPostalCode:01452002
itemId1:0001
shippingAddressDistrict:Jardim Paulistano
itemDescription1:Notebook Prata
currency:BRL
receiverEmail:[email protected]
senderName:Jose Comprador
senderPhone:56273440
shippingAddressComplement:5o andar
shippingAddressCountry:BRA

host: ws.sandbox.pagseguro.uol.com.br
accept: */*
content-type: application/x-www-form-urlencoded; charset=ISO-8859-1
accept-encoding: gzip
connection: Keep-Alive


400
Content-Type: application/xml; charset=ISO-8859-1
<?xml version="1.0" encoding="ISO-8859-1" standalone="yes"?><errors><error><code>53091</code><message>sender hash invalid.</message></error></errors>