Guide
3-D Secure 2: what the backend has to do
Authentication is not a capture. Which states your API has to persist, why the shopper return and the webhook will race, and what not to infer from a redirect.
Topic
webhooks
5articles · all topics
Guide
Out-of-order webhooks: what the handler must do
Payment webhooks do not arrive in causal order. How to apply them with a state machine and an event id, instead of trusting which HTTP request landed first.
Guide
What a payment sandbox will not let you test
A sandbox proves your request is well formed. It does not prove settlement timing, issuer behaviour, or failures that show up only with real cards.
GuideCheckout.com
Checkout.com webhooks: Cko-Signature in ASP.NET Core
How Checkout.com signs webhooks, why the raw body matters in .NET, and how to verify Cko-Signature without breaking model binding.
Guide
Validating webhook signatures in ASP.NET Core
The raw-body trap that breaks HMAC verification in .NET, why == is a vulnerability, and how three real providers sign — including one that does not.