How to accept webhooks?

To verify the notification, you need to :

• Transform the json body into string.
• Concatenate : string-body+gtw-timestamp
• Hash the string using HMAC-SHA256 and Secret Key (coding = UTF8)
• Ensure that the encoded hash in base16 = gtw-signature

Find your Secret Key

You can find your Secret Key needed for the notifications in the Backoffice.

1. Log into your account.

2. Once you created a webhook using this guide.

3. In the webhook details, in the Overview section, you will see the (masked) Secret Key that you can retrieve.

   

Example

• Headers

• JSON notification body

{
  "request_id": "3456789876545678456789765",
  "order_id": "60509208505368000a3dfbd2",
  "transaction_id": "68HGVFT5RTGVU",
  "merchant_order_id": "9J3947DB29D",
  "merchant_contract_id": "489YGF68YGT545678YG",
  "status": "authorization_successful",
  "action_date": "2023-08-12T12:45:48+0000",
  "amount": 118.98,
  "payin_partner": "checkout",
  "payin_transaction_id": "pay_5689IHVFR43456789UYHGVGYU876545678UYG",
  "payin_transaction_description": "APPROVED",
  "authentication_partner": "checkout",
  "authentication_result": "success",
  "risk_assessment_partner": "checkout",
  "risk_assessment_result": "accepted",
  "payment_method": "VISA",
  "capture_total_amount": 0,
  "refund_total_amount": 0,
  "currency": "EUR",
  "is_capturable": true,
  "is_refundable": false,
  "is_cancellable": true,
  "link_interface": "",
  "card_6_digits": "424242",
  "card_4_digits": "4242",
  "card_validity_month": "02",
  "card_validity_year": "25",
  "card_issuer": "",
  "card_country": "GB",
  "merchant_account": "615f3066c67357000ad556e1",
  "token": "072bd9c0b63dde38e2d41e906273d1b59acfe6dea2c3d9a877c8ed7806c2b5eb",
  "is_order_last_transaction": true
}

• Transforming JSON body intro string

{"request_id":"3456789876545678456789765","order_id":"60509208505368000a3dfbd2","transaction_id":"68HGVFT5RTGVU","merchant_order_id":"9J3947DB29D","merchant_contract_id":"489YGF68YGT545678YG","status":"authorization_successful","action_date":"2023-08-12T12:45:48+0000","amount":118.98,"payin_partner":"checkout","payin_transaction_id":"pay_5689IHVFR43456789UYHGVGYU876545678UYG","payin_transaction_description":"APPROVED","authentication_partner":"checkout","authentication_result":"success","risk_assessment_partner":"checkout","risk_assessment_result":"accepted","payment_method":"VISA","capture_total_amount":0,"refund_total_amount":0,"currency":"EUR","is_capturable":true,"is_refundable":false,"is_cancellable":true,"link_interface":"","card_6_digits":"424242","card_4_digits":"4242","card_validity_month":"02","card_validity_year":"25","card_issuer":"","card_country":"GB","merchant_account":"615f3066c67357000ad556e1","token":"072bd9c0b63dde38e2d41e906273d1b59acfe6dea2c3d9a877c8ed7806c2b5eb","is_order_last_transaction":true}

• Concatenate string-body+gtw-timestamp

{"request_id":"3456789876545678456789765","order_id":"60509208505368000a3dfbd2","transaction_id":"68HGVFT5RTGVU","merchant_order_id":"9J3947DB29D","merchant_contract_id":"489YGF68YGT545678YG","status":"authorization_successful","action_date":"2023-08-12T12:45:48+0000","amount":118.98,"payin_partner":"checkout","payin_transaction_id":"pay_5689IHVFR43456789UYHGVGYU876545678UYG","payin_transaction_description":"APPROVED","authentication_partner":"checkout","authentication_result":"success","risk_assessment_partner":"checkout","risk_assessment_result":"accepted","payment_method":"VISA","capture_total_amount":0,"refund_total_amount":0,"currency":"EUR","is_capturable":true,"is_refundable":false,"is_cancellable":true,"link_interface":"","card_6_digits":"424242","card_4_digits":"4242","card_validity_month":"02","card_validity_year":"25","card_issuer":"","card_country":"GB","merchant_account":"615f3066c67357000ad556e1","token":"072bd9c0b63dde38e2d41e906273d1b59acfe6dea2c3d9a877c8ed7806c2b5eb","is_order_last_transaction":true}1639569054

• Hash the previous string using HMAC-SHA256 with SecretKey

  If secret-key=3456789876543235TGY8 , hash= 5a938268e15a97a17f465a540ba0b7c05899b342b61e67aa1b3b1ba74d2f61a9

• Ensure that gtw-signature value equals the encoded hash in the last step