🕸️Handling Webhooks

Learn how to listen for webhook events executed on Lamba

Helpful tip: at the moment, webhook events are currently only emitted for actions performed on the low_fi service.

Receiving webhooks (POST method)

In your webhook endpoint for low_fi, you can obtain the webhook payload in the form:

LowFi Webhook payload

{
  "encryption_key": "enc_key", // your encryption key
  "action_id": "action_id", // the id of the action on Lamba
  "order_id": "order_id", // your `orderId`
  "payment_info": {
    "currency": "currency",
    "amount": 45
   }
}

Please take note of the following points when handling your webhooks:

1. Your webhook endpoint must be able to accept a POST request with JSON payload.

2. Validate the encryption_key to ensure it matches the one in your .env file, specifically the encryption key in your app's API keys section in your Lamba dashboard.

3. Verify the amount and currency returned to confirm they match the value indicated by your order_id in your database. Do not mark the order as fulfilled/completed if the values do not match, as they could have been maliciously tampered with on the client.

4. Choose to either record the actionId to your order record in the database or discard it, noting that it can always be retrieved by querying the fetching payment actions endpoint on Lamba API with your orderId.

5. Acknowledge the webhook notification within 60 seconds to prevent timeouts. Perform any other business logic in the background and quickly return a status code within the range 200 - 299 to acknowledge receipt of the webhook notification.

6. Be aware that failed webhook notifications are resent every 60 seconds for the next 12 minutes (if it keeps failing). After this period, no further notifications will be sent. You must then use your orderId to query the Lamba API fetching payment actions endpoint to fetch the transaction yourself and validate that the status is fulfilled. If the status is not fulfilled, do not credit the user.