When an event occurs, we send you a webhook notification to tell you what's happened so you can take action and keep your business running smoothly.
Webhooks provide a definitive confirmation of a status update and are used for a variety of purposes, such as fulfilling orders, sending automated status updates to customers, or even integrating with third-party application services.
Here are some of our webhooks' best features:
- View a filterable log of all your notifications
- Our webhook retry mechanism for failed webhooks
- Explanations and reasons why a notification failed
- View webhooks for chargebacks and retrievals
In the diagram below, a merchant using Checkout.js has configured a
payment_captured webhook to trigger a notification to the merchant's server confirming the payment.
Click to enlarge.
We highly recommend that you use
payment_captured as the webhook trigger since this is the final state of a processed charge.
Set up your webhooks in the business channel settings section of the Hub or by using our webhook management API. Easily configure multiple webhook endpoints to perform various processes for each of your channels:
- Add or remove webhook endpoints
- Enable or disable a particular endpoint
- Subscribe or unsubscribe your endpoint event types
- Add authorization headers to your endpoints
When a webhook notification fails, the retry mechanism begins. We automatically try to resend the web notification multiple times, before sending you an email informing you of the failure. If we detect that failures are still occurring after a set period of time, we will unsubscribe that event type from the problematic webhook endpoint. This will not affect any other subscribed event types.
You can re-enable, view and configure the webhook at any time in the business level settings of the Hub. However, if you no longer require this particular event type, no further action is necessary.
Amazon’s Simple Queue Service (SQS) features "at-least-once delivery"; this indicates that an endpoint could receive a webhook more than once if we receive duplicate copies of a message. Although this is a rare occurrence, we recommend that endpoints process webhooks in a manner that anticipates duplicates and deals with them appropriately. To do this, save all original webhooks, and when a new webhook is received, disregard it if it already exists.
Requests to an endpoint will time out after 30 seconds. Therefore it's vital for the endpoint to return a
2xx HTTP status code before this time elapses and the request fails.
A webhook signature is a security measure which allows you to verify the integrity and authenticity of the data you’re receiving. Each webhook contains a hash-based message authentication code (
- HMAC -
A hash-based message authentication code (HMAC) is a type of message authentication code involving a cryptographic hash function and a secret cryptographic key. If any change is made to the data being sent, the resulting HMAC will be completely different from the original. Additionally, since the key is known only to the sender and the receiver, no valid HMAC can be regenerated by anyone else.
) in its
CKO-Signature header. Checkout.com generates the HMAC by taking the contents of the webhook notification and hashing it using the
secret key as the key.
Using signatures is simple. All you need to do is take the webhook's body and apply the SHA-256 hash function to it, using the
secret key as the hash key. You then compare the resulting HMAC to the one contained in the
CKO-Signature header. If the HMACs are identical, then the data corresponds to what Checkout.com sent. If they are different, this indicates that the data has been intercepted and altered in some way. You can simply delete the webhook notification and then regenerate it using our webhook management API.
If a merchant account is configured to receive webhook notifications, callbacks will be sent from one of the following IP addresses:
Thanks for using Checkout.com. If you need any help or support, then message our support team at email@example.com.