HMAC-SHA256 Signed · Deterministic event_id · 6-Stage Backoff

Unified Crypto Payment Webhook Events & Delivery Architecture.

Automate order fulfillment, SaaS seat upgrades, player balance top-ups, and ES256 software license issuance with signed, idempotent HMAC-SHA256 webhooks across all 12 supported blockchains.

🧪 Interactive HMAC Webhook Tester 🔐 Signature Verification Deep-Dive 🔁 Idempotency Blueprint ⚖️ Underpaid / Overpaid Guide

Select Event Type (9 Canonical Events)

HTTP Headers & JSON Event Payload


        

    


    

        
Constant-Time HMAC-SHA256 Verification (6 Languages)

        

            
            
            
            
            
            
        

        

    


    

        

            Reliability
            
6-Stage Exponential Retry Schedule

            
Non-2xx responses trigger automatic retries at 30s → 2m → 10m → 1h → 6h → 24h, plus 1-click manual replay inside your Merchant Webhook Logs.

        

        

            Ledger Integrity
            
Unique event_id Idempotency

            
Store event_id as a UNIQUE database key before crediting balances or shipping digital goods so retries never duplicate fulfillment.

        

        

            Outbound Security
            
TLS-Pinned & SSRF-Hardened

            
XPayr enforces strict HTTPS, DNS-pinned public IP resolution, CURLOPT_FOLLOWLOCATION=false, and 5-minute replay-window timestamp headers.

        

    


    

        
Webhooks & Callbacks FAQ

                    

                How do I verify that a webhook genuinely originated from XPayr?
                
Compute HMAC-SHA256 over the exact unparsed raw HTTP request body using your whsec_ endpoint secret and compare the hex digest against X-XPayr-Signature using a constant-time function such as crypto.timingSafeEqual (Node.js), hmac.compare_digest (Python), or hash_equals (PHP).

            

                    

                What is the difference between payment.completed and payment.underpaid_accepted?
                
payment.completed fires when the on-chain transfer equals or exceeds the exact invoice amount. payment.underpaid_accepted fires when a Direct Exchange QR withdrawal lands within XPayr's 1% (max $0.50) tolerance threshold, exposing both requested_amount and received_amount so your ledger stays penny-accurate.

            

                    

                How does XPayr handle endpoint downtime or 5xx responses?
                
Any response outside HTTP 200–299 (or slower than 10 seconds) enters XPayr's exponential backoff retry queue (30s, 2m, 10m, 1h, 6h, 24h) while preserving the identical event_id so your idempotency table prevents double-crediting.

            

                    

                What URL security rules apply to merchant webhook endpoints?
                
Production webhook destinations must use HTTPS over public routable DNS/IPs with valid TLS certificates. XPayr blocks plaintext HTTP, private/loopback RFC1918 ranges, cloud metadata IPs, and HTTP redirects to prevent SSRF.