The address that receives payment notifications is available to anyone who knows it. Without an authenticity check the store would trust an outside request too — so the notification is signed with the secret key, and the handler on the store side must verify that signature.
What happens without verification
- Anyone who knows the handler address and an order id can post a "successful payment" to it.
- The store marks the order paid and ships the goods, while no money arrives.
- The discrepancy surfaces only when reconciling with the payout register — that is, late.
How the signature is verified
- The secret key is known only to you and the service — it is never sent in API requests.
- A checksum is computed from the notification body and the key and passed in a header.
- The handler computes it too and compares: on mismatch the request is rejected with 401.
What to check in your code
- The signature is verified before anything is done with the order, not after.
- Comparison uses a timing-safe function rather than plain string equality.
- A failed request is rejected rather than silently ignored — otherwise nobody notices the problem.
What to do if the secret key leaks is covered separately.
