Overview
Authenticated, at-least-once webhook delivery.
Webhooks are the primary asynchronous settlement signal: blockchain transfer → BramaPay matching → invoice state change → signed delivery to your backend.
BramaPay webhook protocol v2 signs every delivery with HMAC-SHA256. Delivery is at least once: retries and manual redelivery keep the same event identity but use a fresh timestamp and attempt number. Verify before parsing for business use, persist the event atomically with your fulfillment decision, then return a small 2xx response.
Use an authenticated GET /v1/invoices/:invoiceId lookup as an additional server-to-server check when needed. Neither a browser redirect nor a customer-supplied transaction hash replaces webhook verification.