This article explains how to set up webhook notifications for payments.
For payments initiated via the API , Allpay sends a webhook by default in response to the API request. No additional configuration is required.
The setup described below is needed in two cases: if you want to receive webhook notifications for payments created not via the API, but through payment links, or if you need to specify an additional URL for sending webhook notifications as part of your API integration.
What is webhook Webhook is an automatic event notification sent by the Allpay system to an external URL.
When a payment is successfully completed, Allpay sends a POST request to the specified address. The request contains full payment details, including the buyer's name, the payment description, and the amount.
Developers and integrators use webhooks to:
automatically trigger actions (e.g. activating an order or sending an email to the customer), synchronize data between systems, eliminate the need for manual payment status checks. Even types Allpay supports webhooks for two events — successful payment and refund.
For subscriptions, the webhook is automatically sent to the specified URL each month after a successful recurring charge.
Where to configure a webhook A webhook is configured separately for each payment link or API integration:
Payment link — in the settings of that specific link. In this case, the webhook will be sent for every payment made via that link.API integration — in the settings of a specific integration under the <span class="u-richtext-element">API Integrations</span> section. This allows you to receive webhooks for all payments processed through that integration — for example, from your site on WordPress, or another platform.Allpay does not have a centralized webhook setting for all payments. This approach gives you flexible control over notifications across different channels.
Webhook request contents Allpay sends a POST request to the specified URL. The request body is a JSON object containing parameters related to the event.
Example request POST /c96zv6ri852dvppncccdg6fxkjnpwojg HTTP/ 2
Host: hook.eu2.make.com
accept: * /*
content-type:application/json
content-length: 453
{
"name": "Consultation",
"items": [
{
"name": "Consultation",
"price": 150,
"qty": 2,
"vat": "1"
},
{
"name": "Clock",
"price": 50,
"qty": 1,
"vat": "1"
}
],
"amount": "350",
"status": 1,
"client_name": "Tanur Mikrogalov",
"client_email": "test@email.com",
"client_tehudat": "123456789",
"client_phone": "+972 58 569 8877",
"foreign_card": "0",
"card_mask": "455743******3431",
"card_brand": "visa",
"receipt": "",
"inst": 1,
"sign": "83f6fab69f7b237ee2db5d9993b84b5fe89ef722af6206a0ffe64480501f3784"
}
Each payment for which a webhook was sent is marked with a corresponding label. By clicking on this label, you can view the full contents of the request.
add_field parameter If you add <span class="u-richtext-element">?add_field=any-string</span> to the payment link URL, this parameter will be included in the Webhook request body. Learn more.
Webhook security Allpay supports two methods for verifying the authenticity of webhook requests:
Verification using the Webhook secret key This method relies on an HMAC signature based on the SHA256 algorithm.
Signature generation algorithm: Remove the <span class="u-richtext-element">sign</span> parameter from the request. Exclude all parameters with empty values. Sort the remaining keys in alphabetical order. From the sorted list, take the parameter values and join them into a single string using a colon (:) as a separator. Append your Webhook secret key to the end of the string, preceded by a colon. Apply the SHA256 algorithm to the resulting string. Compare the result with the <span class="u-richtext-element">sign</span> parameter received in the request. Platforms like Zapier support this type of verification using built-in tools, such as a custom script in Code by Zapier.
Example JavaScript for Zapier const webhookKey = "YOUR WEBHOOK SECRET KEY" ;
// Parse the input params from JSON string to an object
const params = JSON .parse(inputData.params || '{}' );
// Store the original signature from the request
const requestSignature = params.sign || null ;
// Remove the 'sign' parameter before calculating the signature
delete params.sign;
function getApiSignature ( params, webhookKey ) {
// Filter out empty values and sort keys alphabetically
const sortedKeys = Object .keys(params)
.filter( ( key ) => {
const value = params[key];
return value !== null && value !== undefined && String (value).trim() !== '' ;
})
.sort();
// Collect the values in sorted key order, process nested arrays (like "items")
const chunks = [];
sortedKeys.forEach( key => {
const value = params[key];
if ( Array .isArray(value)) {
value.forEach( item => {
if ( typeof item === 'object' && item !== null ) {
Object .keys(item).sort().forEach( subKey => {
const val = item[subKey];
if (val !== null && val !== undefined && String (val).trim() !== '' ) {
chunks.push( String (val).trim());
}
});
}
});
} else {
chunks.push( String (value).trim());
}
});
// Build the string to hash
const baseString = chunks.join( ':' ) + ':' + webhookKey;
// Generate SHA256 hash
const crypto = require ( 'crypto' );
const hash = crypto.createHash( 'sha256' ).update(baseString).digest( 'hex' );
return { baseString, verifiedSignature : hash };
}
// Generate the signature
const result = getApiSignature(params, webhookKey);
// Return the original and calculated values
output = {
requestSignature : requestSignature,
baseString : result.baseString,
verifiedSignature : result.verifiedSignature
};
Demo of webhook verification on Zapier VIDEO
IP address verification A simpler but less secure method is to check that the request comes from Allpay’s server IP address. You can request the current IP address by contacting our support team.
Webhook delivery and retries Your server must return an <span class="u-richtext-element">200 OK</span> response to confirm successful receipt of a webhook. If any other status is returned, or the request fails due to a timeout or network error, Allpay will automatically retry delivery.
Allpay performs up to 10 delivery attempts in total. The first retry is made 1 minute after the initial failure. Subsequent retries are sent with progressively increasing intervals, with the final attempt occurring within 24 hours of the original request.
If all delivery attempts fail, the webhook will be marked as failed and no further retries will be made.
