Webhooks and notifications

Use Settings → Push notifications for notification destinations and event/channel preferences. Use Developers → Webhook logs to inspect outgoing webhook deliveries and resend delivered or failed attempts.

HTTP notifications send the JSON body with:

• X-Signature: HMAC-SHA256 hex digest of the raw body using the store notification secret.
• X-Timestamp: Unix timestamp in seconds.
• Idempotency-Key: stable delivery key for idempotent processing.

Deliveries are durable and normally retry up to three attempts. The log stores request and response evidence.

import { createHmac, timingSafeEqual } from 'node:crypto';

export function verifyPaidGoodsWebhook(rawBody, signature, secret) {
  const expected = createHmac('sha256', secret).update(rawBody).digest('hex');
  const a = Buffer.from(signature, 'hex');
  const b = Buffer.from(expected, 'hex');
  return a.length === b.length && timingSafeEqual(a, b);
}

Rotate or reveal the notification signing secret from the store secret tools. Treat webhook handlers as idempotent because providers and merchants can retry.