Verified BursaPay workflow: Verify BursaPay webhook signatures before trusting incoming event data.
1. Overview & Purpose
BursaPay signs webhook payloads and exposes the timestamp/signature information needed for application-side verification.
2. Requirements & Setup
The webhook secret returned when the endpoint is created must be stored server-side.
3. Step-by-Step Workflow
- Read the signature header and timestamp.
- Reconstruct the signed message using the documented payload format.
- Calculate the HMAC with the stored webhook secret.
- Reject payloads with an invalid signature or stale security context.
4. Rules & Troubleshooting
Never log or expose the webhook secret. Treat an invalid signature as untrusted input.
5. Verification & Next Steps
Record successful verification status in your own webhook processing logs.