Verify a FaucetPay v2 payout webhook
payout.sent and payout.failed arrive signed. Check the HMAC, dedupe on the event id, and let the webhook correct a payout your send call never heard about.
Tagged “webhooks”
7 entries
Post to a Discord channel with a webhook
No bot, no token, no OAuth — a URL you POST JSON to. Embeds give structure, and the same rate guard applies.
Verify a Coinbase Commerce webhook
HMAC-SHA256 of the raw body against the X-CC-Webhook-Signature header, and the event types that actually mean money arrived.
Verify a CoinPayments IPN before you credit it
The HMAC is over the raw POST body, not the parsed array. Rebuilding it from $_POST is why so many handlers reject every callback.
Handle an offerwall postback without paying twice
Signature check, unique constraint, credit inside a transaction. Networks retry postbacks, so the same completion will arrive more than once.
Fetch a user-supplied URL without opening an SSRF hole
Postback URLs, webhook targets and site verification all mean fetching an address someone else chose. This is the guarded version.
Verify a FaucetPay merchant payment before crediting it
Verifying a merchant callback server-side, including the endpoint shape that quietly 404s. Still current; see the v2 entry for the retry schedule and order-first ordering.