Webhooks and verifying signatures
Get notified the moment money arrives, and verify every delivery.
Updated
Add an endpoint in Developers → Gateway webhooks (one per mode). You'll receive events such as payment.success, payment.failed, payment.expired and payment.reversed.
Verify every delivery. Each request carries X-ShubhGateway-Event-ID, X-ShubhGateway-Timestamp and X-ShubhGateway-Signature: v1=<hex> — an HMAC-SHA256 of "{timestamp}.{raw body}" with your webhook secret. Compute it over the raw body, compare in constant time, reject timestamps older than 5 minutes, and ignore event ids you've already processed.
Respond with 2xx quickly. Failed deliveries are retried after 1m, 5m, 15m, 30m, 1h, 3h, 6h and 24h. You can inspect and re-send deliveries from the dashboard, and fetch a payment's status any time with the API.