BramaPay Docs

Configure Webhooks

Register an HTTPS receiver and protect its one-time secret.

In Dashboard → Developers → Webhooks, add a public HTTPS endpoint controlled by your backend. Endpoint creation returns secret and keyId; store the secret immediately because it is shown once.

Your handler should:

  1. accept POST requests over HTTPS;
  2. retain the exact raw UTF-8 request body;
  3. enforce a small request-size limit;
  4. verify every v2 header and the HMAC before using JSON data;
  5. deduplicate X-Event-Id in durable storage;
  6. return 2xx after durable acceptance.

Rotating a secret returns a new secret and key ID for future deliveries. Already-created deliveries retain their signing snapshot, so retain old secrets long enough to verify outstanding deliveries identified by X-Key-Id.

Project readiness requires at least one active endpoint. Use the test action before accepting live traffic.