Verify a CoinPayments IPN before you credit it
The HMAC is over the raw POST body, not the parsed array. Rebuilding it from $_POST is why so many handlers reject every callback.
Tagged “ipn”
2 entries
2 entries
The HMAC is over the raw POST body, not the parsed array. Rebuilding it from $_POST is why so many handlers reject every callback.
The callback from FaucetPay's merchant checkout is not proof of payment. Here is the server-side verify call, including the endpoint shape that quietly 404s if you get it wrong.