How does my system verify that a webhook came from the platform?
Each delivery is signed. Your receiving system recomputes the signature from the payload, the timestamp and the Merchant Account Secret Key, using the signature algorithm set on the endpoint, then compares the result with the signature header. Supported algorithms run from MD5 and SHA-1 through SHA-256, SHA-384 and SHA-512. Signature verification is the recommended control, and it stays reliable across delivery infrastructure changes.
In detail
Every webhook delivery is signed, so your receiving system can confirm that it came from the platform and was not altered on the way.
How verification works
- Your system takes the payload, the timestamp and the Merchant Account Secret Key.
- It recomputes the signature with the algorithm set on the endpoint.
- It compares the result with the signature header of the request, and rejects the delivery when they differ.
The algorithm is a setting on each endpoint, with options running from MD5 and SHA-1 through SHA-256, SHA-384 and SHA-512. Choose the strongest option your receiving stack supports, and keep the secret key out of source code and logs.
Signature verification is the recommended control, rather than relying on source IP addresses. It stays reliable when delivery infrastructure changes, and it binds each request to its content and its timestamp, which also helps your system reject replayed requests.
When something does not verify, the evidence is in the Console. Each event detail lists the calls made for it, with the signature and timestamp of every attempt, alongside the request and response payloads. Your merchants and your support team can compare what was sent with what the receiving system computed, and resend the event once the issue is fixed.