Why Webhook Security Matters
A webhook tells your server that a payment was successful. If an attacker can spoof this webhook, they can trick your system into fulfilling unpaid orders, leading to massive financial losses.
Signature Verification
Trust Gateway sends an X-Gateway-Signature derived from canonical order fields with HMAC-SHA256. Recreate the documented signing input with your account's secret, compare signatures safely, and check the amount and order reference before processing the order. Do not assume the signature covers the raw JSON bytes.
Idempotency
Always design your webhook handlers to be idempotent. This means if Trust Gateway sends the exact same webhook twice (which can happen during network retries), your system should only process the order fulfillment once.
Questions about your own setup? Review the developer documentation or open your merchant dashboard.