Step 6: webhooks

Webhooks for your first PSB integration: register topics, return 2xx within 100s, verify HMAC SHA256 signatures.

Without webhooks you only see synchronous API responses. Delivery status, retries and receipt run asynchronously — hooks belong in every serious integration.

Minimal setup in the sandbox
  1. Publish an HTTPS endpoint that can receive JSON (temporary: a tunnel such as ngrok is fine for accp)
  2. Register a hook with topic InvoiceSent (send) and/or InvoiceReceived (receive)
  3. Respond within 100 seconds with HTTP 2xx
  4. Verify the HMAC SHA256 signature before you trust the payload

Exact registration API, headers and retry behaviour: Set up webhooks.

What to see in the first test
  1. Send an invoice (step 5)
  2. Receive a hook for the send event
  3. Log topic, document/correlation id and verification result
  4. Deliberately force a non-2xx to see retries start — then restore 2xx
Security
  • Do not put the hook secret in client-side code
  • Use separate secrets/URLs for accp and production
  • Reject requests with an invalid signature (and log them)
Done with Getting started?

Continue with: