Reputation: 1718
I am currently integrating the "PayPal Smart Payment Buttons" into a WebApp. Passing custom fields and receiving a Webhook / Purchase Confirmation with this data works quite fine.
I am having trouble with validating a received Webhook. The Documentation is poor and leads mit either to v1 (deprecated) or to v2 Java SDK where nothing is mentioned about Webhook verification.
I integrated the following SDK in Java.
<dependency>
<groupId>com.paypal.sdk</groupId>
<artifactId>checkout-sdk</artifactId>
<version>1.0.2</version>
</dependency>
But I am not able to find a way to verify a Webhook. Did I read over something or how can I achieve the Webhook verification?
Upvotes: 3
Views: 2159
Reputation: 101
Had exactly the same issue as you, thats why I created my own API for handling that: https://github.com/Osiris-Team/PayHook
It's using the official PayPal-Rest API for validation, here is an example:
MyPayPal paypal = new MyPayPal(clientId, clientSecret, MyPayPal.Mode.SANDBOX);
PaypalWebhookEvent event = new PaypalWebhookEvent(paypalWebhookId, paypalWebhookEventTypes, header, body);
if(!paypal.isWebhookEventValid(event)){
System.err.println("Received invalid PayPal webhook event.");
return;
}
Besides validating webhook events it also provides other useful methods for interacting with the PayPal REST API that are not available in the official Java-SDK.
Hope I could help, have a nice day!
Upvotes: 0
Reputation: 30457
There is no supported SDK for webhook integration
(The references to old SDKs on this page: https://developer.paypal.com/docs/integration/direct/webhooks/rest-webhooks/#verify-event-notifications are out of date)
So, you have some choices.
DIY verification, using the information in the event headers: https://developer.paypal.com/docs/integration/direct/webhooks/notification-messages/#event-headers
Direct integration with the HTTPS APIs: https://developer.paypal.com/docs/api/webhooks/v1/#verify-webhook-signature
Don't use webhooks, at all, for anything, and instead switch your integration to a server side implementation that does not need webhooks.
The last option is actually what I would recommend.
Here is the server-side SDK you need: https://github.com/paypal/Checkout-Java-SDK
With that you would implement two routes, one for "Set Up Transaction" (create order), and one for "Capture Transaction" (capture the order). There is a guide for these steps here: https://developer.paypal.com/docs/checkout/reference/server-integration/
The web front-end that will then connect to those two server-side routes is: https://developer.paypal.com/demo/checkout/#/pattern/server
There is no need for webhooks when using this server-side integration; you have an immediate response of success or failure when doing the capture on the server.
Upvotes: 1