Purpose
Gateways POST to/api/{gateway}/webhook. Handlers verify signatures, locate the order, and call completeOrderFromGateway → fulfillment.
Gateways with webhook routes
adyen, amazon-ps, authorizenet, cryptomus, lemon-squeezy, misticpay, mollie, nowpayments, paypal, revolut, shopify, skrill, square, stripe, sumup, whop.
PayPal also exposes /api/paypal/ipn.
Integrator checklist
- Configure the webhook URL in the gateway dashboard to your deployment (
https://YOUR_APP_ORIGIN/api/stripe/webhook, etc.). - Store the signing secret in server env / seller payment settings — never in embed JS.
- Expect retries from the gateway; handlers should be idempotent with respect to already-paid orders.
- CSRF is exempt for these prefixes; signature verification is the auth layer.