I have complected transactions then the sagepay server return the response of following values.
[VendorTxCode] => 14-10-31-10-49-36-196489754
[VPSTxId
Based on the request object documented in this Sagepay API documentation, you need to pass a field named "RelatedSecurityKey".
You would have been given the value for this as part of the Sagepay response when you first registered the transaction (at the same point you get the "NextUrl" for your redirect/iframe) - at which point it is just called "SecurityKey" - you should store this value in the database for reuse later.