Callback Verification

Verifying Callback Signatures

When the system sends a callback to your callbackUrl, the request body includes a signature field. You should verify it to ensure the callback is authentic.

Callback Payload for example

{
  "operationId": "uuid",
  "operationType": "deposit",
  "status": 1,
  "amount": "100.00",
  "currency": "USDT",
  "paymentMethod": "card",
  "merchantOperationId": "order-001",
  "signature": "hex-string"
}

Callback Signature Verification

The callback signature is computed as HMAC-SHA256 over the JSON-stringified payload (all fields except signature, keys sorted alphabetically).

Callback Verification

Verifying Callback Signatures#

Callback Payload for example#

Callback Signature Verification#

Verifying Callback Signatures

Callback Payload for example

Callback Signature Verification