Verify Signatures

Critical: Never process webhook payloads without verifying authenticity when a signing secret is configured.

Best practices

Practice	Detail
HTTPS only	Never accept webhooks over plain HTTP
Verify signatures	Validate HMAC or shared secret when provided
Allowlist IPs	Restrict to DigetPay outbound IPs (contact support for list)
Idempotent handlers	Deduplicate by `transactionId` + `type`
Fast 200 response	Acknowledge within seconds; process async

Important: Reject webhooks with invalid signatures using 401 Unauthorized — do not process the payload.

Signature verification flow

sequenceDiagram
    autonumber
    participant DigetPay as DigetPay
    participant Merchant as Your Server

    DigetPay->>Merchant: POST webhook + X-DigetPay-Signature header
    Merchant->>Merchant: Compute HMAC(payload, webhook_secret)
    alt Signature matches
        Merchant->>Merchant: Process event
        Merchant-->>DigetPay: 200 OK
    else Signature invalid
        Merchant-->>DigetPay: 401 Unauthorized
    end

Incoming request format

{
  "headers": {
    "Content-Type": "application/json",
    "X-DigetPay-Signature": "sha256=computed_hmac_hex"
  },
  "body": {
    "transactionId": "2232e99b-0257-47d5-bbfd-022c8951767f",
    "orderId": "PAY-1781872369616",
    "status": "Approved",
    "type": "Sale"
  }
}

Compute HMAC over the raw request body exactly as received — do not re-serialize JSON before verifying.

Webhook secret

Obtain your webhook signing secret when creating a webhook in the Merchant Portal. Store it in your secrets manager alongside your API key.

{
  "webhookSecret": "whsec_store_in_secrets_manager",
  "storage": "Never commit to Git or log in production"
}

Emergency — secret exposed: Rotate the webhook immediately via Portal API and update your verification logic before the old secret is revoked.

Never log full webhook payloads or secrets in production logs.

Verified handler: Return 200 only after signature validation passes and the event is accepted for processing.