[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"questions:item:en:why-webhooks-are-signed":3},{"id":4,"title":5,"answer":6,"body":7,"category":77,"description":78,"extension":79,"meta":80,"modifiedAt":81,"navigation":82,"pairId":83,"path":84,"publishedAt":85,"question":86,"relatedPath":87,"seo":88,"seoTitle":89,"sitemap":90,"slug":91,"stem":92,"translationSlug":93,"__hash__":94},"questions_en\u002Fen\u002Fquestions\u002Fwhy-webhooks-are-signed.md","Why Webhooks Are Signed","The address that receives payment notifications is available to anyone who knows it. Without an authenticity check the store would trust an outside request too — so the notification is signed with the secret key, and the handler on the store side must verify that signature.",{"type":8,"value":9,"toc":70},"minimark",[10,13,18,31,35,46,50,61],[11,12,6],"p",{},[14,15,17],"h2",{"id":16},"what-happens-without-verification","What happens without verification",[19,20,21,25,28],"ul",{},[22,23,24],"li",{},"Anyone who knows the handler address and an order id can post a \"successful payment\" to it.",[22,26,27],{},"The store marks the order paid and ships the goods, while no money arrives.",[22,29,30],{},"The discrepancy surfaces only when reconciling with the payout register — that is, late.",[14,32,34],{"id":33},"how-the-signature-is-verified","How the signature is verified",[19,36,37,40,43],{},[22,38,39],{},"The secret key is known only to you and the service — it is never sent in API requests.",[22,41,42],{},"A checksum is computed from the notification body and the key and passed in a header.",[22,44,45],{},"The handler computes it too and compares: on mismatch the request is rejected with 401.",[14,47,49],{"id":48},"what-to-check-in-your-code","What to check in your code",[19,51,52,55,58],{},[22,53,54],{},"The signature is verified before anything is done with the order, not after.",[22,56,57],{},"Comparison uses a timing-safe function rather than plain string equality.",[22,59,60],{},"A failed request is rejected rather than silently ignored — otherwise nobody notices the problem.",[11,62,63,64,69],{},"What to do if the secret key leaks is covered ",[65,66,68],"a",{"href":67},"\u002Fen\u002Fquestions\u002Fwhat-if-the-secret-key-leaks","separately",".",{"title":71,"searchDepth":72,"depth":72,"links":73},"",2,[74,75,76],{"id":16,"depth":72,"text":17},{"id":33,"depth":72,"text":34},{"id":48,"depth":72,"text":49},"security","The webhook address is available to anyone who knows your site. Why the notification is signed and why the store must verify the signature itself.","md",{},null,true,"question-39","\u002Fen\u002Fquestions\u002Fwhy-webhooks-are-signed","2026-08-17","Why are payment notifications signed?","\u002Fen\u002Fpayment-api",{"description":78},"Webhook signature: why a store needs it",{"loc":84},"why-webhooks-are-signed","en\u002Fquestions\u002Fwhy-webhooks-are-signed","zachem-podpisyvayutsya-vebhuki","kIz01y9uA6vIGdRJ5gYlfFu3DWIWUWxo8JMF5kHVlw4"]