This webhook documentation outlines how to integrate and handle payment notifications from HeedPay. When a payment is successfully processed, a webhook notification will be sent to your provided URL. This webhook contains information regarding the transaction, including the status, amount, sender, receiver, and other relevant details.

Virtual-Account-Payment Webhook sample

You are advice to verify real authentication of the transaction by

Always Verify HeedPAy webhooks:

Webhook security is critical. Your HeedPay webhook URL is publicly accessible, which means anyone can send a fake request pretending to be HeedPay. To prevent your system from processing fraudulent transactions, always verify every incoming webhook before acting on it. Follow these steps every time a webhook arrives.

Compare Sign Key:

Before proceeding to honor the received webhook, it is crucial to compare your sign Key with the hashed "api_key" present in the header section and your business id. This verification step ensures that the request is legitimate and enhances the security of your integration with HeedPay.

Prevent Duplicate Transactions:

Always verify transactions by querying the transaction reference before proceeding to honor the received webhook. This additional step ensures that you confirm the transaction details and enhances the reliability of your transaction processing workflow.

Requery Transaction:

Alway requery transaction with our fetch transaction details endpoint to reconfirm the transaction before you honor it the received webhook.

By incorporating the following security measures, you can fortify your webhook endpoint against data tampering, validate the authenticity of requests from trusted origins, and mitigate the risk of duplicate transaction processing. These steps will bolster the overall security and dependability of your webhook integration with HeedPay.