Webhook

This is the request we make to the callback URL you have sent on the merchant dashboard

Endpoint

POST {YOUR CALLBACK URL}

How to set up a signed webhook

Log in to your XtraPay Account and go to:

Settings → Developers → API Keys & Webhooks.

Find the Callback Secret field, click to update, enter your secret key (without spaces), and then click Save.

NOTE: After configuring your webhook, every callback sent to your server will include an HMAC-SHA256 signature. You should verify this signature to confirm that the webhook originated from XtraPay and that the payload has not been altered during transmission.

Headers

Authorization: Bearer API_KEY

Name	Key	Description
Signature	signature	The signature is an HMAC SHA256 hash of the raw webhook payload, generated using your Merchant Callback Secret. It is included in the request header to verify the source and integrity of the webhook. The signature header is present only when a secret is configured; otherwise, it is not included.
Content Type	Content Type	application/json

Request Body

Parameters	Type	Description
status integer	Required	Custom Status Code. See Status Codes
message string	Required	Payment Status Description
amount string	Required	Payment Amount
transaction_id string	Required	Payment Transaction ID
currency string	Required	Payment Currency
business_code string	Required	Your business code

How to Validate Webhook

PHP

signature = request.headers["signature"]

if signature exists:
    payload = request.raw_body
    secret  = "YOUR_MERCHANT_CALLBACK_SECRET"

    computed = HMAC_SHA256(payload, secret)

    if secure_compare(computed, signature) is false:
        return HTTP 401 Unauthorized

process webhook
return HTTP 200 OK