Payments

What is Webhook?

A webhook is an HTTP request sent by one service to notify another about an event. Delivery is commonly retried and can be delayed or duplicated, so receivers should authenticate the raw request, reject stale messages, and durably deduplicate event identifiers.

A valid signature proves that a message was signed by a party with the corresponding secret; it does not prove every field is correct or that a payment settled. The receiver should validate the event schema, look up authoritative payment state, and apply changes idempotently.

Use the unmodified request bytes for signature verification when required by the provider. Keep the signing secret private, compare signatures safely, and put slow downstream work on a durable queue.

Definitions are educational and general. Nothing here is financial, legal or tax advice, and regulatory descriptions summarise frameworks that change — check the current rules for your jurisdiction before relying on them.