Webhook Validation

To ensure security, every webhook notification must be validated using a hash.

Webhook validation and is the only trusted way to confirm that a payment notification:

• Was sent by EdfaPay
• Was not altered during transmission

Webhook Validation Concept

Webhook validation is based on a shared-secret hash mechanism.

• EdfaPay generates a hash using transaction data and the merchant’s secret PASSWORD
• The same hash is recalculated by the merchant upon receiving the webhook
• If both hashes match, the webhook is considered authentic.

General Validation Method

Regardless of the integration type, the webhook validation process is always the same:

1. Receive the webhook request from EdfaPay
2. Read the webhook payload parameters
3. Recalculate the webhook hash using the correct formula
4. Compare your calculated hash with the hash sent by EdfaPay
5. Validation result:
   • ✅ Hashes match → Webhook is valid
   • ❌ Hashes do not match → Webhook must be rejected or ignored

Webhook Hash Calculation

The webhook hash formula depends on the integration flow used.

Checkout Webhook Hash

Used for Checkout integrations.

MD5(strtoupper(strrev(email) + PASSWORD + trans_id + strrev(substr(card_number,0,6) + substr(card_number,-4))))

Parameters:

• email → Customer email
• PASSWORD → Merchant password
• trans_id → Transaction ID generated by EdfaPay
• card_number → Card number (first 6 and last 4 digits only)

The hash sent in the initiate request should not match the hash received in the webhook notification.

Server-to-Server (S2S) Webhook Hash

Used for Server-to-Server (S2S) Embedded integrations.
This hash follows the same logic used in the SALE request.

MD5(strtoupper(strrev(email).PASSWORD.strrev(substr(card_number,0,6).substr(card_number,-4))))

Parameters:

• email → Customer email
• PASSWORD → Merchant password
• card_number → Card number (first 6 and last 4 digits only)

trans_id is not included in S2S webhook hash calculation.

Validation Rules

• Use the correct hash formula based on the integration type
• Don't compare webhook hash with initiate hash

Security Notes

• Treat merchant key and merchant PASSWORD as strictly confidential
• Always use HTTPS for the webhook endpoint
• Reject invalid webhook requests silently
• Make sure the webhook endpoint are never shared with anyone