Webhook Integration Best Practices

Verifying Signatures

Every webhook includes an X-Africoders-Signature header. Verify it to ensure the request came from us.

$signature = hash_hmac('sha256', $payload, $webhookSecret);\nif ($signature !== $request->header('X-Africoders-Signature')) {\n    abort(401);\n}

Idempotency

Webhooks may be sent multiple times. Use the event_id to deduplicate.