In Solidgate, asynchronous events for payments, subscriptions, and chargebacks are facilitated through webhooks, ensuring our clients receive all the necessary information. A webhook consists of a URL provided by the external application, and the payment system sends an HTTP request to that URL when a subscribed event occurs. Solidgate then sends a POST request to the merchant’s endpoint, containing event details in the request body.

Here is an overview on how webhooks work in Solidgate:

Receive webhooks

If you opt to receive identical events across multiple endpoints, webhook notifications are dispatched to all specified endpoints.

Delivery attempts

If the webhook notification fails due to an incorrect response, the retry mechanism automatically makes several attempts to resend it.

Notification delivery attempts follow the structured schedule below:

Security

Webhook event security is handled similarly to API authentication. In each notification, you receive the Guide
Learn to authenticate API requests and generate signatures. merchant and Guide
Learn to authenticate API requests and generate signatures. signature values in the headers.

• The merchant value corresponds to the webhook Guide
  Learn to authenticate API requests and retrieve your credentials. public key wh_pk_
• The signature value is calculated using the webhook public and secret keys, which helps verify the authenticity and integrity of the webhook data transmitted between Solidgate and the merchant’s server.
  
  The data variable within the generateSignature function pertains to the payload transmitted via the webhook. This data can include event-related information, like order events, and is sent by Solidgate as part of the triggering HTTP request body.

You need to retrieve the merchant wh_pk_ from the request headers and verify if you possess the corresponding credentials.

Generate a signature from the received body using the generateSignature function, as you would when sending a request to a gateway.

1
2
3
4
5
6

public function generateSignature ($ data)
{
  return base64_encode (
  hash_hmac ('sha512', $ wh_pk. $ data. $ wh_pk, $ wh_sk_)
  );
}

Event handling

Occasionally, you may receive duplicate events during notification retries or when resending requested events. To mitigate this, consider implementing idempotent processing in your integration.

Each action’s unique event ID, provided in the request header parameters, is crucial for monitoring and managing webhook events.

Handling non-ordered events

In Solidgate, webhooks are essential for asynchronous event communication, such as payments, subscriptions, and chargebacks. It’s important to understand that the order of received webhook events may not always match the sequence of their occurrence. This section offers guidance on effectively managing non-ordered events.

Best practices

Managing non-ordered events

• Accumulating webhooks: Temporarily store incoming webhooks (e.g., for about a minute) before processing. This delay allows for the collection of all relevant webhooks, aiding in more accurate event processing.
• Handling event collisions: In cases where an event cannot be processed due to insufficient data, often resulting from delayed delivery of some events, utilize the Solidgate API to retrieve the necessary information.

General recommendation

• Asynchronous event processing: Implement a queue-based approach for processing incoming events, rather than handling them synchronously. This is crucial due to the timeout constraints on webhook sending. Synchronous processing that exceeds the timeout limit may lead to webhooks being marked as undelivered, which can complicate the order of event processing.

Adopting these best practices enables merchants to effectively manage non-ordered events in webhooks, ensuring accurate and reliable event processing in their systems.