Webhook security best practices

1. Verify the signature with your signing secret on every request.
2. Check the timestamp and reject anything older than a few minutes.
3. Be idempotent: the same event can arrive twice; store the event id or check the order state.
4. Use HTTPS on a public address. UPIPayments refuses webhook URLs pointing to private or internal addresses.

Respond quickly

Return a 2xx within a few seconds and do heavy work in the background. Failed deliveries are retried after 1, 5, 30, 120, 360 and 720 minutes, and every attempt is visible in your delivery log with a retry button.

Rotate the secret

If you suspect the signing secret leaked, create a new one under Developers › Webhooks and update your server.