How do I verify a webhook?

Compute an HMAC-SHA256 of timestamp.body with your signing secret and compare it with the signature header in constant time.

---

Related articles

• Is there an API?
• How do I test my integration?
• Should I fulfil orders on the return page?
• What if my webhook endpoint is down?
• Can I send the same order twice?

← Back