How to verify the requests when working with Revolut webhook?

Question

I followed this guide (https://developer.revolut.com/docs/accept-payments/tutorials/using-webhooks/#2-receive-and-handle-the-web-callback) to handle order status event when webhook come to. But I do not know how to make sure the requests exactly come from Revolut?

I google-ed for a day, but I don't see anyone mentioned it.

Answer 1

you need to follow this instructions in doc, they explain the payload, the signing verification (which i am unable to fix yet) and you can create and endpoint for listen those requests, but remember first to check the webhook subscription doc here. You need to subscribe a webhook from your system to the events you need, save the signing secret they provide in the response for so you can verify integrity later and then you create an endpoint for wait hits like documentation explain. I used ngrok to publish my local app and I create the webhook using that url as callback and then I was able to check everything well. Good look, if you need more help ask for it