Developers / Guides
Receive webhooks
Verify signatures, respond to retries correctly, and keep the timeline as source of truth.
Register an endpoint
Add an HTTPS URL in the dashboard and select events. Each event is delivered as a signed POST body within 30 seconds of the state change.
Verify the signature
Every delivery carries an Examplepay-Signature header with a timestamp and an HMAC you check against your endpoint secret. Reject deliveries older than five minutes to stop replay.
Design for retries
Failed deliveries retry with exponential backoff for 24 hours. Handlers must be idempotent: the same event id can arrive more than once. Respond 2xx before slow work; queue anything heavy.
Test mode needs no approval
Request a demo key and follow this guide against your own flows.