Payment webhooks

Endpoints

/api/payments/waffo/webhook verifies X-SIGNATURE (RSA-SHA256) over the original UTF-8 body then queries the official SDK for confirmed facts. API responses require signatures. Committed processing returns HTTP 200 with {"message":"success"}, otherwise {"message":"failed"}. Never reserialize before verification.

/api/payments/creem/webhook verifies HMAC-SHA256 creem-signature. subscription.paid may contain only last_transaction_id; fetch actual transaction facts, never substitute an event ID for a payment ID.

Transactions and idempotency

Match merchant/user/request/order/amount/currency/paid period. Deduplicate real payment IDs and subscription periods. Order/payment/subscription/balance/ledger/schedule commit together; user-first lock ordering is shared with cron/refund handling.

Refund/dispute marks review_required and stops future grants. Ordinary cancellation retains paid installments.

Acceptance

Configure the exact HTTPS endpoint and verification key/secret in your merchant environment. Check original signatures, duplicate/out-of-order/missing facts, renewals/timeouts/retries. Never grant from URL success parameters. Do not replay into production or store real keys in the template.

Pancake endpoint

/api/payments/pancake/webhook verifies X-Waffo-Signature (millisecond t, RSA-SHA256 of t.rawBody), checks store/mode and queries authenticated order/payment facts. Reconcile chargedAmount and listPrice against frozen full-price one-time terms, not deprecated amount or buyer email. Durable receipts deduplicate event deliveries; payment IDs/ledger transactions prevent repeated grants. Refund notifications mark review without blindly subtracting credits. Processing/configuration failure returns a non-success HTTP status for retry. A completed query alone never grants; missing deliveries require operator reconciliation. Never recreate an uncertain checkout; the original write idempotency key is retained, and the provider cache lasts only 24 hours.