Webhooks and Security for Pay-later payment method

[Gemma]

Hi,

I'm currently building a solution to add "Pay Later" functionality in Loyverse Pos. I'm using the service of Klarna In-Store for this, which is specifically designed for physical stores.  

My current solution works by adding a Klarna-payment method inside Loyverse. A receipts.update webhook triggers the integration with Klarna and creates a new payment-session with a copy of the receipt inside Klarna. A separate web interface allows to complete the payment method, by sending a form to the users phone (email/phone/QR). (They have to fill it in for credit-checks etc.) Also refund-receipts are synchronised to Klarna, so the customer only has to pay for what they keep. 

 

Now I want to validate the webhook for security, but it seems the mentioned headers are not sent currently.
Also the validation algorithm seems to be missing from the docs;

https://developer.loyverse.com/docs/#section/Webhooks-overview/Validate-notifications

 

Any information about this?

[Jay Rock]

Webhook was created  by token created by Oauth2 authorization?

Edited August 3, 2021 by Jay Rock

[Gemma]

3 hours ago, Jay Rock said:

Webhook was created  by token created by Oauth2 authorization?

Hmm, I did not. I created it from the Loyverse dashboard  

That could be a difference indeed, I will test again. Thanks! 

Edited August 3, 2021 by Gemma

[Gemma]

I created the webhook using the api, authenticated with OAuth2 and it works now! Thanks again.

I was able to validate the webhook using the following PHP-function;

hash_hmac('sha1', $data, $key, false)

 

[Starup]

Hey @Gemma, could you please instruct me how to set up webhook using the api, authenticated with OAuth2? I am struggling with setting up wedhooks. Thanks in advance.

[Gemma]

Did u check this
https://developer.loyverse.com/docs/#tag/Webhooks/paths/~1webhooks~1/post

 

Code I'm using;

$webhook = array(
        'url' => 'https://url/url.php',
        'type' => 'receipts.update',
        'status' => 'ENABLED',
);
$result = CallAPI('POST', 'https://api.loyverse.com/v1.0/webhooks/', json_encode($webhook), $token);