payment.completed events from OwnPay and updates your order database. By the end you will have a production-ready endpoint in PHP or Node.js.
What you will build
A single endpoint (/webhooks/ownpay) that:
- Verifies the HMAC-SHA256 signature
- Parses the event payload
- Updates the order status in your database
- Returns the correct HTTP response codes
Prerequisites
- An OwnPay instance with a webhook endpoint configured in Developers → Webhooks
- A webhook signing secret (shown when you create the endpoint)
- PHP 8.1+ or Node.js 18+ with Express
Security best practices
- Verify the signature on every request - never skip it
- Reject events with timestamps older than 5 minutes to prevent replay attacks
- Only process events you have registered for - ignore unknown event types
- Use HTTPS exclusively - OwnPay never sends webhooks to HTTP endpoints
- Keep your webhook secret in environment variables, never in code