Reference examples for webhook payloads sent by the system. These are not API endpoints - they are sent to your configured postbackUrl.HMAC Signature Verification:
If webhookSecret was provided during transaction creation, the X-Webhook-Signature header will contain the HMAC-SHA256 signature of the request body.1.
Get the raw request body (as string)
2.
Compute HMAC-SHA256 using your webhookSecret
3.
Compare with the X-Webhook-Signature header value
4.
Only process the webhook if signatures match
Modificado em 2025-12-29 21:29:45