Payment Webhooks

Event types

Event	Meaning
`payment.succeeded`	The payment completed successfully.
`payment.declined`	The issuer refused the card (insufficient funds, blocked, expired). The customer can retry with a different card.
`payment.failed`	A system or processor error prevented completion (timeout, internal error, acquirer unavailable). Not a card problem; the customer did nothing wrong.
`payment.expired`	The originating Payment Link or Payment Intent expired before payment.

Integration flow

Create an HTTPS endpoint with the event types you want.

Store its signing secret

Retrieve the endpoint-specific whsec_ value and keep it in a secret manager.

Verify every delivery

Verify the raw body and Webhook-* headers before parsing or processing it.

Persist, acknowledge, and process

Deduplicate on the event id, durably store it, return 2xx, then do slow work asynchronously.

Quickstart

Manage URLs, events, and signing secrets.

Understand identifiers, statuses, and timestamps.

Verify Standard Webhooks signatures safely.

Retry schedule, deduplication, and manual retriggering.

SUBMITTED means the event was accepted for delivery. It does not prove that every merchant endpoint returned 2xx.