
In the Payment Gateway purchase flow, the actors are defined as the following:
In this flow step 4 is the webhook trigger.
A webhook is a simple HTTP request done by PayMaya over the web to inform the Merchants of changes of the statuses of their Payments.
No. In the transaction flow only PayMaya can reliably give the Merchant the correct Payment Status information. This is provided in either the webhook or the GET Payment API.
No. Redirection is still unreliable. There are many use cases wherein the Customer does not redirect back to the Merchant website.
To name a few:
Yes. As long as the batch job polls up to at least 1 hour after the Payment creation and a maximum interval of 1 per minute.
Your system will be vulnerable to the following issues:
For Shopify, No.
For Woocommerce, it comes with a built in webhook receiver. You only need to register the URL.
For Magento, you need to set it up.
It must accept a POST request on SSL port 443. Port 80 is allowed for Sandbox only. The recommended processing is as follows:
For the responses:
Body is not required in the webhook response.
You may register your webhook endpoints thru the Settings page on PayMaya Manager or via the webhook API of your availed Product.
Checkout Webhook
Payment Vault Webhook
Pay With PayMaya Webhook
Webhooks are triggered on the following events
| Webhook Name | Event |
|---|---|
| CHECKOUT_SUCCESS | On successful Checkouts |
| CHECKOUT_FAILURE | On failed Checkouts |
| CHECKOUT_DROPOUT | On expired Checkouts |
| 3DS_PAYMENT_SUCCESS | On success Payment Vault 3ds Payments |
| 3DS_PAYMENT_FAILURE | On failure of Payment Vault 3ds Payments |
| 3DS_PAYMENT_DROPOUT | On expiry of Payment Vault 3ds Payments |
| RECURRING_PAYMENT_SUCCESS | On success of Subscription Payments |
| RECURRING_PAYMENT_FAILURE | On failure of Subscription Payments |
| PAYMENT_SUCCESS | On ANY Payment Success |
| PAYMENT_FAILED | On ANY Payment Failed |
| PAYMENT_EXPIRED | On ANY Payment Expiry |
Altho not always available on PayMaya Manager, it is recommended to use the generic PAYMENT_SUCCESS, PAYMENT_FAILED, PAYMENT_EXPIRED webhooks. This can only be done thru API.
It is recommend to set all three webhooks for the set of the product you availed or all three generic webhooks. The bare minimum would be at least the success webhook of your availed product.
For Checkout webhooks the payload can be found here
For all other webhooks the payload is equivalent to the contents of the GET Payment API.
PayMaya’s Webhook will trigger a maximum of 4 times.
You may do a GET Payment to update your records. You may also manually trigger webhook calls via PayMaya Manager.
The webhook tester is for connectivity purposes and sends a dummy payload over POST. Use this to smoke test connections from PayMaya to your servers.
For actual testing of your webhook endpoints, we recommend doing test transactions or using the retrigger webhook on PayMaya Manager.
Always use HTTPS with at least TLS 1.2 for the webhook endpoint. We recommend whitelisting our webhook servers IP address.
The following IP addresses are for Sandbox:
The following IP addresses are for Production:
Please make sure your endpoint is accessible publicly thru the web.
PayMaya cannot send webhooks to “localhosts”. You might want to check https://ngrok.com/
Please make sure your SSL certificate is not self signed, missing any certificate chains, and supports TLS1.2.
Our Merchant Services team will validate your setup. Please send us a few Payment Ids wherein you did you testing.
Last updated on 1/17/2020
Written with StackEdit.