Glossary

HMAC

Cryptographic signature sent along with the webhook that proves the notification actually came from the platform and wasn't tampered with.

HMAC is a code calculated from the content of the message and a secret key that only the platform and you know. It travels in a header, alongside the webhook.

On your end, you recalculate the same code with the same key and compare them. If they match, the notification is legitimate and no one altered the data along the way. If they don't match, you discard it.

Without this check, anyone who discovers your webhook's address could send a fake approved-sale notification and unlock access to your product for free.

Documentation exists so a seller never learns a rule on the day it costs them. Worth reading before you need it.
Wellington CostaGlobal Payments Specialist

Need to deal with hmac in practice?

Mundpay processes payments in 190 countries with local currency checkout, a human risk team and fast payouts. Open an account and test it against your own operation.

Abrir minha conta na Mundpay

Written by Wellington Costa Global Payments Specialist

Writes about payment infrastructure, checkout conversion and chargeback reduction. Works directly with digital product sellers, affiliates and creators selling to more than 40 countries through Mundpay.