Webhooks deliver real-time payment notifications directly to your server. But if not implemented carefully, they can become a security vulnerability. Here are five essential practices.
1. Always verify the signature
Every InzoPay webhook includes an InzoPay-Signature header with an HMAC-SHA256 signature. Always verify it using your endpoint's signing secret before processing the event. See our signature verification guide.
2. Check the timestamp
Verify that the webhook timestamp (t=) is within 5 minutes of the current time. This prevents replay attacks where an attacker resends a captured webhook.
3. Return 200 quickly
Process webhooks asynchronously. Immediately return a 200 response, then handle the event in the background. If your server takes more than 10 seconds, InzoPay will consider the delivery failed.
4. Handle duplicate events
Due to retries, your endpoint may receive the same event more than once. Use the event ID (event.id) to implement idempotency — skip processing if you have already handled that event.
5. Use HTTPS only
InzoPay only delivers webhooks to HTTPS endpoints. Never use HTTP for webhook endpoints in production.