Webhook

A webhook is an automated HTTP notification that one system sends to another when a specific event occurs. In payments, webhooks are how payment providers, gateways, and Payments Orchestration Platforms notify merchants of transaction events in real time, an authorization completing, a payment succeeding, a chargeback being filed, a Stored Credential being updated, or an Alternative Payment Method (APM) transaction resolving after a delay.

The mechanics are straightforward. The merchant registers a URL (their webhook endpoint) with their payment provider. When an event occurs, say, a transaction is authorized, the provider sends an HTTP POST request to that URL with a payload describing the event. The merchant's server receives the payload, processes it, and responds with a 200 OK to confirm receipt. If delivery fails, well-designed webhook systems will retry with exponential backoff until delivery is confirmed.

Webhooks are essential for payment methods that involve asynchronous resolution. A Bank Redirect payment, for example, is initiated at checkout but may not be confirmed for minutes or hours as the customer completes authentication at their bank. A SEPA direct debit may take days to settle. BNPL transactions involve a credit check and approval step that happens outside the checkout flow. In all of these cases, the merchant cannot rely on a synchronous API response, they depend on webhooks to receive the final transaction outcome.

Secure webhook implementations verify the authenticity of incoming notifications using a signature, a hash of the payload signed with a shared secret. Merchants should always validate webhook signatures before acting on the payload, to prevent attackers from sending fraudulent event notifications.