Receive payment updates
Register a dedicated HTTPS endpoint with the onboarding team. Payment notifications are asynchronous POST requests with a JSON body. Restrict the endpoint to the expected request method and accept only the documented event shapes.
Verify before changing an order
- Validate the signature using the exact algorithm, field ordering and encoding specified for your integration. Store the secret on your server and use a constant-time comparison for the expected and received signatures.
- Locate the original attempt by its gateway identifier or stored merchant reference. Compare the amount and currency with the original request and route mismatches for review.
- Apply allowed state changes in one durable operation. Treat an already applied event as a successful duplicate. Preserve a terminal state if an older update arrives later.
- After accepting the update, return the acknowledgement specified for your integration. Keep slower actions such as order fulfilment outside the callback response path.
Recover from a late or missing update
Keep the attempt pending until you can check its status from your server. If the customer retries, link the new attempt to the same order and inspect both results before fulfilling. Escalate an unresolved mismatch using the merchant reference, gateway identifier, amount and timestamps.
Review the checkout integration for the original request flow and the reconciliation guide for daily exception handling.