Guide
3-D Secure 2: what the backend has to do
Authentication is not a capture. Which states your API has to persist, why the shopper return and the webhook will race, and what not to infer from a redirect.
Topic
aspnet-core
6articles · all topics
GuideHTTP
Idempotency keys for payment endpoints in .NET
How to make a charge endpoint safe to retry: key scope, hashing the raw body, the 409 on a mismatched payload, and the race a unique index has to close.
Guide
Out-of-order webhooks: what the handler must do
Payment webhooks do not arrive in causal order. How to apply them with a state machine and an event id, instead of trusting which HTTP request landed first.
Guide
Retry and backoff for payment APIs in .NET
Which payment HTTP failures are safe to retry, why a timeout is not one of them, and how backoff without an idempotency key charges the customer twice.
GuideCheckout.com
Checkout.com webhooks: Cko-Signature in ASP.NET Core
How Checkout.com signs webhooks, why the raw body matters in .NET, and how to verify Cko-Signature without breaking model binding.
Guide
Validating webhook signatures in ASP.NET Core
The raw-body trap that breaks HMAC verification in .NET, why == is a vulnerability, and how three real providers sign — including one that does not.