Skip to main content

Webhook Events

A webhook is a way to provide other applications with real-time information. When an event occurs in the payFURL (such as a new charge is created), payFURL sends a request to a specified URL (known as a "webhook URL").

This allows other applications to take action based on the event, such as sending an email or creating a new record in a database. Webhooks are typically used to integrate one application with another, allowing them to work together in real time.

How to create a webhook​

While creating a charge you could provide an optional webhook object:

{
  "webhook": {
    "url": "https://webhook.site/1752c235-7693-466b-9710-f6ca4e0f8255",
    "authorization": "Basic dXNlcjpwYXNzd29yZA=="
  }
}
  • url is required, should be HTTPS and not an IP address
  • authorization is optional and will be sent to webhook URL in the authorization header

Event when webhook will be sent​

  1. Successful payment;
  2. Failed payment;
  3. Status update of the transaction;
  4. Refunds and partial refunds.

Example of webhook​

Content-Type: application/json
Authorization: Basic dXNlcjpwYXNzd29yZA==
X-Payfurl-Version: 1.17.1.0
X-Payfurl-Signature: dCM6l9ngZMJXVappk73yS607k1K7byfyzTTdToaKMa8=

Verify Signature​

Since your notification URL is publicly accessible and can be reached by anyone, it's necessary to verify each event notification to ensure that it was sent by payFURL.

An event notification that did not come from payFURL could potentially compromise your application. All webhook notifications from payFURL include an X-Payfurl-Signature header.

This header contains an HMAC-SHA-256 signature that is generated using your webhook signature key and the body of the request. To validate the webhook notification, you need to generate the HMAC-SHA-256 value based on webhook signing key (copy from payFURL dashboard) in your code and compare it to the signature of the event notification you received.

For deserializing webhook please use SDKs:

var transaction = payfurl.sdk.WebhookTools.DeserializeTransaction(requestBody, signatureHeader, webhookSignatureKey);