Webhook is an automatic event notification sent by the Allpay system to an external URL.
When a payment is successfully completed, Allpay sends a POST request to the specified address. The request contains full payment details, including the buyer's name, the payment description, and the amount.
Developers and integrators use webhooks to:
- automatically trigger actions (e.g. activating an order or sending an email to the customer),
- synchronize data between systems,
- eliminate the need for manual payment status checks.
Even types
Currently, Allpay supports a webhook for one event only — successful payment.
For subscriptions, the webhook is automatically sent to the specified URL each month after a successful recurring charge.
Where to configure a webhook
A webhook is configured separately for each payment link or API integration:
- Payment link — in the settings of that specific link. In this case, the webhook will be sent for every payment made via that link.
- API integration — in the settings of a specific integration under the <span class="u-richtext-element">API Integrations</span> section. This allows you to receive webhooks for all payments processed through that integration — for example, from your site on WordPress, or another platform.
Allpay does not have a centralized webhook setting for all payments. This approach gives you flexible control over notifications across different channels.
Webhook request contents
Allpay sends a POST request to the specified URL. The request body is a JSON object containing parameters related to the event.
Example request
POST /tjefkki4vvsvfyhrmudkr571bvjxw5g7 HTTP/2
Host: hook.eu2.make.com
accept: */*
content-type:application/json
content-length: 653
{
"name": "Test payment",
"items": "[{\"name\":\"Test payment\",\"price\":10,\"qty\":1}]",
"amount": "10",
"status": 1,
"client_name": "Tanur Mikrogalov",
"client_email": "test@allpay.co.il",
"client_tehudat": "",
"client_phone": "",
"foreign_card": "0",
"card_mask": "407517******9285",
"card_brand": "visa",
"receipt": "https:\/\/www.allpay.co.il\/receipt.pdf",
"sign": "2367eefa04752fae489fc233670fce599be9083af8c9a581d4c7684ec33c0114"
}
Each payment for which a webhook was sent is marked with a corresponding label. By clicking on this label, you can view the full contents of the request.
Webhook security
Allpay supports two methods for verifying the authenticity of webhook requests:
Verification using the Webhook secret key
This method relies on an HMAC signature based on the SHA256 algorithm.
Signature generation algorithm:
- Remove the <span class="u-richtext-element">sign</span> parameter from the request.
- Exclude all parameters with empty values.
- Sort the remaining keys in alphabetical order.
- From the sorted list, take the parameter values and join them into a single string using a colon (
:) as a separator. - Append your Webhook secret key to the end of the string, preceded by a colon.
- Apply the SHA256 algorithm to the resulting string.
- Compare the result with the <span class="u-richtext-element">sign</span> parameter received in the request.
Platforms like Zapier support this type of verification using built-in tools, such as a custom script in Code by Zapier.
Example JavaScript for Zapier
const webhookKey = "YOUR WEBHOOK SECRET KEY";
// Parse the input params from JSON string to an object
const params = JSON.parse(inputData.params || '{}');
// Store the original signature from the request
const requestSignature = params.sign || null;
// Remove the 'sign' parameter before calculating the signature
delete params.sign;
function getApiSignature(params, webhookKey) {
// Filter out empty values and sort keys alphabetically
const sortedKeys = Object.keys(params)
.filter((key) => {
const value = params[key];
return value !== null && value !== undefined && String(value).trim() !== '';
})
.sort();
// Collect the values in sorted key order
const chunks = sortedKeys.map(key => String(params[key]).trim());
// Build the string to hash
const baseString = chunks.join(':') + ':' + webhookKey;
// Generate SHA256 hash
const crypto = require('crypto');
const hash = crypto.createHash('sha256').update(baseString).digest('hex');
``
return { baseString, verifiedSignature: hash };
}
// Generate the signature
const result = getApiSignature(params, webhookKey);
// Return the original and calculated values
output = {
requestSignature: requestSignature,
baseString: result.baseString,
verifiedSignature: result.verifiedSignature
};
Demo of webhook verification on Zapier
IP address verification
A simpler but less secure method is to check that the request comes from Allpay’s server IP address. You can request the current IP address by contacting our support team.
Retries and webhook deactivation
Your service must return a 200 HTTP status code to confirm successful receipt of the webhook. If any other status code is returned, the system will attempt to resend the webhook up to three more times. After that, the request will be considered failed and will not be retried.
If Allpay repeatedly encounters delivery errors when attempting to send webhook requests, the corresponding webhook will be automatically deactivated to prevent further attempts.
