Post to a Discord channel with a webhook
No bot, no token, no OAuth — a URL you POST JSON to. Embeds give structure, and the same rate guard applies.
Tagged “webhooks”
6 entries
Verify a Coinbase Commerce webhook
HMAC-SHA256 of the raw body against the X-CC-Webhook-Signature header, and the event types that actually mean money arrived.
Verify a CoinPayments IPN before you credit it
The HMAC is over the raw POST body, not the parsed array. Rebuilding it from $_POST is why so many handlers reject every callback.
Handle an offerwall postback without paying twice
Signature check, unique constraint, credit inside a transaction. Networks retry postbacks, so the same completion will arrive more than once.
Fetch a user-supplied URL without opening an SSRF hole
Postback URLs, webhook targets and site verification all mean fetching an address someone else chose. This is the guarded version.
Verify a FaucetPay merchant payment before crediting it
The callback from FaucetPay's merchant checkout is not proof of payment. Here is the server-side verify call, including the endpoint shape that quietly 404s if you get it wrong.