Payzuno

Webhooks

Payzuno POSTs a signed event to your endpoint whenever a payment or payout changes state.

Headers

  • X-Webhook-Signature — v1=HMAC-SHA256(secret, "{timestamp}.{raw body}"), hex.
  • X-Webhook-Timestamp — unix seconds, bound into the signature to stop replays.

Verify before you act

const mac = crypto.createHmac("sha256", secret)
  .update(`${timestamp}.${rawBody}`).digest("hex");
const ok = `v1=${mac}` === signatureHeader
  // constant-time compare in production
  && Math.abs(Date.now()/1000 - Number(timestamp)) < 300;

Rules

  • Verify over the raw body bytes, not a re-serialised object.
  • Reject anything outside a ±5-minute window.
  • Retry-safe: delivery retries with backoff, so return 2xx only after you have stored the event.
  • Credit on the on-chain confirmation; treat the webhook as the trigger, the status endpoint as the record.
PreviousRefundsNextError Codes