Webhooks
Prepare your application to process event notifications.
Contract status
Event names, payloads, signature verification, acknowledgment requirements, and delivery policies have not yet been published. This guide describes receiver preparation; it does not establish KPPAY delivery guarantees.
Receiver preparation
Create a dedicated HTTPS endpoint when the event contract is available. Verify each request using the documented signature scheme before trusting its contents. Preserve the raw body if the verification method requires it.
Process events safely
Validate the payload, record its documented identifier, and prevent repeat delivery from repeating the same business action. Separate receipt from long-running work when the contract permits it.
Do not assume events arrive once or in order. Confirm the source of truth for the current state before applying a transition.
Recover from failures
Confirm retry timing, acknowledgment codes, and replay options with KPPAY. Record enough context to investigate an event without logging credentials or unnecessary personal data.
Test your receiver
Cover valid and invalid signatures, malformed payloads, duplicates, delayed events, and processing failures using approved test fixtures.