Webhook security

Treat every webhook request as security-sensitive input. A webhook can trigger business actions such as granting access, updating an order, or changing a subscription, so your receiver must validate requests and limit what it does before validation succeeds.

Secure your receiver

• Use HTTPS and keep the endpoint dedicated to webhook delivery.
• Follow the authentication or signature-verification procedure provided with your PayNowPro webhook configuration. Do not invent a verification scheme or assume that an event is trusted without validating it.
• Check that the event type and payload match the event contract you enabled.
• Process requests on the server; never expose webhook credentials or verification material in browser or mobile code.
• Restrict access to delivery logs and remove secrets or sensitive payment data before sharing logs.

Avoid unsafe side effects

Do not use an inbound webhook request alone to make irreversible changes. First validate it, then use durable, idempotent processing to apply the appropriate business change. For payment and subscription access, reconcile the event with the PayNowPro identifiers and state your application already stores.

Test before production

Before enabling production webhooks, test that your receiver:

1. Rejects invalid requests without changing application state.
2. Handles valid notifications for every event type you enable.
3. Safely processes repeat delivery attempts.
4. Does not reveal payloads, credentials, or internal errors in responses.
5. Alerts your team when delivery failures need investigation.

For payment-data handling and support escalation, read Security, compliance, and support.