Webhooks/Callbacks

Webhook Authenticity Verification

You can verify the Message Authentication Code (MAC) of a given callback using the HMAC SHA-512 algorithm. The MAC ensures data integrity and authenticity by enabling the recipient to verify that the message has not been altered.

Header key: nmac Message Value: payReference (data["payReference"]) 

Sample Header

{
 "nmac": "6377f9fae71eedb408f45b5fb2f70e5cdab8f415f993707aeb0e2f2484238f65fe788084b4c354fcf0b7113aa380b7f6fb9e024dc5c0f32b745bc3198350cbb9",
 "Content-Type": "application/json"
}

Method to Calculate HMAC SHA-512

Here is the method to compute the HMAC SHA-512, as provided:

Java Version

public static String calculateHMACSHA512(String payReferenceString, String secretKey) {
    try {
        String algorithm = "HmacSHA512";
        Mac mac = Mac.getInstance(algorithm);
        SecretKeySpec secretKeySpec = new SecretKeySpec(secretKey.getBytes(), algorithm);
        mac.init(secretKeySpec);

        byte[] rawHmac = mac.doFinal(payReferenceString.getBytes());
        return bytesToHex(rawHmac);
    } catch (NoSuchAlgorithmException | InvalidKeyException ex) {
        System.out.println("Error Calculating SHA512 Mac");
    }
    return null;
}

private static String bytesToHex(byte[] bytes) {
    StringBuilder hexString = new StringBuilder();
    for (byte b : bytes) {
        String hex = Integer.toHexString(0xff & b);
        if (hex.length() == 1) hexString.append('0');
        hexString.append(hex);
    }
    return hexString.toString();
}

PHP Version

Javascript Version

Verification Logic

  1. Compute the MAC: Use the provided calculateHMACSHA512 method to compute the MAC for the given message and secret key.

  2. Compare MACs: Compare the computed MAC with the providedMac in a time-constant manner to prevent timing attacks.

All our Webhook/Callback are sent via HTTP Method to the specified url provided by Merchant.

Payout Webhook Event Types

Payins Webhook Events

Sample Webhook Responses

PreviousWallet Transaction HistoryNextWebhook Repush

Last updated