Skip to main content

Test Webhooks

Sandbox payments POST the same signed webhook as production, so you can validate your handler end to end without real crypto.

Setup​

  1. Create a isSandbox: true payment with a webhookUrl pointing at your endpoint (plain HTTP and localhost work in development).
  2. Have your gateway's webhook signing secret configured in your server.

Test the signature check​

  • Recompute HMAC-SHA256 over the raw request body with your secret and compare constant-time against X-Webhook-Signature — parse the JSON only after it matches.
  • Tamper with the body or use the wrong secret and confirm your handler rejects it with 401.

Test retries​

The platform retries on any non-2xx response (6 attempts, backoff 15s/1m/5m/30m/2h).

  • Respond 500 once and confirm the redelivery ~15s later succeeds.
  • Deliver the same event twice and confirm your handler dedupes by paymentId (at-least-once delivery).
  • Respond 200 fast, then verify + fulfil asynchronously.

Test the miss case​

  • Take your endpoint down past the retry window and confirm your reconciliation sweep still resolves the payment by polling verify.