Webhooks

When an event occurs, we send you a webhook notification to tell you what's happened so you can take action and keep your business running smoothly.

Webhooks provide a definitive confirmation of a status update and are used for a variety of purposes, such as fulfilling orders, sending automated status updates to customers, or even integrating with third-party application services.

Here are some of our webhooks' best features:

• View a filterable log of all your notifications
• Our webhook retry mechanism for failed webhooks
• Explanations and reasons why a notification failed
• View webhooks for chargebacks and retrievals

Webhooks example

In the diagram below, a merchant using Checkout.js has configured a payment_captured webhook to trigger a notification to the merchant's server confirming the payment.

📘

We highly recommend that you use payment_captured as the webhook trigger since this is the final state of a processed charge.

Setting up webhooks

Set up your webhooks in the business channel settings section of the Hub or by using our webhook management API. Easily configure multiple webhook endpoints to perform various processes for each of your channels:

• Add or remove webhook endpoints
• Enable or disable a particular endpoint
• Subscribe or unsubscribe your endpoint event types
• Add authorization headers to your endpoints

Webhook retries

When a webhook notification fails, the retry mechanism begins. We automatically try to resend the web notification multiple times before sending you an email informing you of the failure. The best-effort retries are set to happen after 5 minutes, 15 minutes, 30 minutes, 1 hour, 2 hours, 4 hours, and 8 hours. If we detect that failures are still occurring after a set period of time, we will unsubscribe that event type from the problematic webhook endpoint. This will not affect any other subscribed event types.

You can re-enable, view and configure the webhook at any time in the business level settings of the Hub. However, if you no longer require this particular event type, no further action is necessary.

📘

Please note:

Amazon’s Simple Queue Service (SQS) features "at-least-once delivery"; this indicates that an endpoint could receive a webhook more than once if we receive duplicate copies of a message. Although this is a rare occurrence, we recommend that endpoints process webhooks in a manner that anticipates duplicates and deals with them appropriately. To do this, save all original webhooks, and when a new webhook is received, disregard it if it already exists.

Requests to an endpoint will time out after 30 seconds. Therefore it's vital for the endpoint to return a 2xx HTTP status code before this time elapses and the request fails.

Webhook signatures

A webhook signature is a security measure which allows you to verify the integrity and authenticity of the data you’re receiving. Each webhook contains a hash-based message authentication code (HMAC) in its CKO-Signature header. Checkout.com generates the HMAC by taking the contents of the webhook notification and hashing it using the secret key as the key.

Using signatures is simple. All you need to do is take the webhook's body and apply the SHA-256 hash function to it, using the secret key as the hash key. You then compare the resulting HMAC to the one contained in the CKO-Signature header. If the HMACs are identical, then the data corresponds to what Checkout.com sent. If they are different, this indicates that the data has been intercepted and altered in some way. You can simply delete the webhook notification and then regenerate it using our webhook management API.

Implementing a fallback logic

Because webhook notifications are asynchronous, we recommend implementing a fallback logic in case you experience any delivery delays that could affect your cardholders' journey.

The fallback logic should be applied when no authorization or capture webhooks have been received within ~15 seconds after they were expected to be received.

1. Call the GET payment details endpoint using the payment ID obtained in the authorization response. You can find instructions on how to do this here.
2. Check the status field in the response to find out the current status of the payment. For example, "status": "Captured".

Alternatively, you can use the GET payment actions endpoint to list all the different statuses the payment has been through so far.

IP addresses

If a merchant account is configured to receive webhook notifications, callbacks will be sent from one of the following IP addresses:

Can we help?

Thanks for using Checkout.com. If you need any help or support, then message our support team at [email protected].