Webhooks Integration
Webhooks (Callbacks) allow STSPoint to push asynchronous notifications to your server the moment a transaction status changes. This eliminates the need for constant status polling and ensures your application reacts instantly to user payments and product fulfillment.
How it works
Register Endpoint
Provide your URL in the X-Callback-URL header or the Dashboard Settings.
Automated POST
STSPoint sends a secure JSON POST request to your endpoint as soon as an event (e.g., Payment Success) is triggered.
ACK & Process
Your server verifies the signature, responds with 200 OK, and processes the order internally.
Signature Verification
To ensure the webhook data originates from official STSPoint infrastructure, every request includes an X-STS-Signature header.
Verification Process:
Method: Generate an HMAC SHA256 hash of the raw JSON body.
Secret: Use your
Webhook Secret(fallback: Secret Key) found in Console.Compare: Match your generated hash with the one in the header.
Event Payloads
The structure of the JSON payload varies depending on the service module.
{
"event": "payment.paid",
"data": {
"external_id": "PAY-1730-XXXX",
"status": "PAID",
"amount": 50000,
"payer_email": "customer@email.com",
"timestamp": "2024-10-24T08:42:11Z"
}
}{
"event": "ppob.status_update",
"data": {
"ref_id": "ORDER-9921",
"sku": "TSEL10",
"target": "081234567890",
"status": "Success",
"sn": "83294829384923",
"message": "Transaction successful",
"timestamp": "2024-10-24T08:42:11Z"
}
}Important Implementation Notes
Acknowledgement
Your server must return an HTTP 200 status code within 10 seconds. Any other code (or timeout) will be considered a failure.
Retry Policy
If delivery fails, our system will attempt to redeliver the webhook up to 3 times with an exponential backoff strategy.
Webhook Dispatcher v1.2 • Secure Transmission