AutoCore Payment Webhook and Audit Security
Explains signature verification, idempotency, reconciliation, and audit behavior for payment callbacks.
Payment callbacks are public transport endpoints with private verification requirements. The service verifies provider-specific signatures, hashes payloads, deduplicates provider event IDs, reconciles amounts and currencies, and applies state changes transactionally.
Release candidate source
This article reflects the audited AutoCore source revision 7a504f6e430c16d4fcb03ebdea3cc3fb7816df60 and immutable release-candidate tag v1.0.0-rc.1 at 9edfb109f44cc80385784c694b96392cfc04e70f. Configuration and external provider behavior remain deployment-dependent.
Source boundary
| Control | Source-verified behavior |
|---|---|
| Iyzico | Uses the provider's v3 HMAC controls and response verification; sandbox configuration is required by the reviewed source. |
| Stripe | Verifies the raw body, timestamp tolerance, and HMAC signature before parsing the event. |
| PayPal | Uses the provider verification endpoint with the required signed headers and webhook identifier. |
| Replay boundary | There is no generic cross-provider timestamp contract; replay and freshness controls remain provider-specific and must be tested per adapter. |
| Audit | Webhook receipt, processing outcome, attempt/order result, and operator-visible errors are recorded without storing raw provider payloads in the order record. |
High-risk operation
Use explicit authorization, a written reason, a confirmation gate, and post-action verification. Documentation does not grant permission to change a deployment.
Operational controls
Use the smallest verified control for the task. Keep provider, host, legal, and operator responsibilities separate from application behavior. When a control is not implemented or not verified, leave it disabled or mark it as a limitation.
Verification
Verify the route, relevant API or configuration state, negative path, audit/evidence result, and public effect before closing the task. Record unknown or configuration-dependent behavior as a limitation.