Solidgate uses webhooks to handle asynchronous events for payments, subscriptions, and chargebacks. This ensures you receive all necessary information. A webhook uses your external application’s URL and sends HTTP requests when subscribed events occur. Solidgate sends POST requests to your merchant endpoint with event details in the request body.

Manage webhooks

Solidgate offers webhooks to notify your system about various events, ensuring communication and providing a way to build automated workflows.

At the core of webhook configuration is the endpoint. It defines how and where events are delivered and includes the following:

• Event types to receive
• Destination URL for delivery
• Identifier for event routing
• Descriptive name for configuration

Endpoints are identified by:

• url - the HTTP destination for webhook events
• channel_id - the delivery channel identifier

This combination ensures webhook events are sent to the correct destination using the right channel.

Card payments

Alternative payments

Subscription

Taxes

Delivery attempts

If the webhook notification fails due to an incorrect response, the retry mechanism automatically makes several attempts to resend it.

Notification delivery attempts follow the structured schedule below:

Security

Webhook event security is handled similarly to API authentication. In each notification, you receive the Guide
Learn to authenticate API requests and generate signatures. merchant and Guide
Learn to authenticate API requests and generate signatures. signature values in the headers.

• merchant value corresponds to the webhook Guide
  Learn to authenticate API requests and retrieve your credentials. public key wh_pk_.
• signature value is calculated using the webhook public and secret keys, which helps verify the authenticity and integrity of the webhook data transmitted between Solidgate and the merchant’s server.
  The data variable within the generateSignature function refers to the payload sent via the webhook. This data can include event-related information, like order events, and is sent by Solidgate as part of the triggering HTTP request body.

Retrieve the merchant wh_pk_ from the request headers and verify if you possess the corresponding credentials.

Generate a signature from the received body using the generateSignature function, as you would when sending a request to a gateway.

When generating a signature, it is essential to use the raw JSON data exactly as it is received in the body of the API request. Avoid any modifications or processing through serializers, as these can alter the structure of the data, leading to signature mismatches.

• Double-check that the jsonString used for signature generation matches the body received in the API request without alterations.
• Ensure that data passed into the generateSignature function retains its original structure and format to preserve data integrity.

1
2
3
4
5
6

public function generateSignature ($ data)
{
  return base64_encode (
  hash_hmac ('sha512', $ wh_pk. $ data. $ wh_pk, $ wh_sk_)
  );
}

Event handling

Occasionally, you may receive duplicate events during notification retries or when resending requested events. To mitigate this, implement idempotent processing in your integration using the unique event ID provided in the request headers. This approach prevents negative effects from duplicate events without requiring additional verification of the request body content.

The event ID provides a reliable mechanism for preventing duplicates and managing events efficiently.

Handle non-ordered events

Solidgate webhooks enable asynchronous event communication for payments, subscriptions, and chargebacks. However, the order of received webhook events may not always match the sequence of their occurrence. Use the solidgate-event-created-at timestamp to determine the actual chronological order of events.

By following these best practices, you can manage non-ordered events in webhooks, which ensures accurate and reliable event processing in your system.