Admin

Webhooks

Monitor events, target URLs, signatures and delivery attempts.

A webhook delivers a signed event from an external system, such as a payment provider. Receiving the request does not mean the event has been verified and processed.

Verification

Check signature, secret, provider, environment and event ID before changing state. Reject invalid or unexpected requests without exposing sensitive details.

Idempotency

The same event may be delivered more than once. Processing must recognise duplicates and avoid charging, crediting or unlocking twice.

Diagnosis

Review time, HTTP status, attempt count and shortened error. Secrets and complete customer data must not appear in webhook logs.