Verified BursaPay workflow: Explain the two main security checks on the internal Paystack webhook receiver.
1. Overview & Purpose
The Paystack webhook receiver validates the caller IP against an allowlist and then verifies the X-Paystack-Signature HMAC-SHA512 header.
2. Requirements & Setup
A correct Paystack secret and the configured allowlist are required server-side.
3. Step-by-Step Workflow
- Receive the POST request.
- Reject clients outside the configured Paystack IP allowlist.
- Check that X-Paystack-Signature exists.
- Verify the HMAC-SHA512 signature before parsing business events.
4. Rules & Troubleshooting
The receiver is CSRF-exempt because Paystack is an external caller, but that does not remove the IP and signature checks.
5. Verification & Next Steps
Monitor rejected webhook attempts and keep the allowlist configurable when infrastructure changes.