Security Token (Optional)

For each API key, iPay can provide a webhook secret token to enhance security. This token is sent in the authorization HTTP header of every callback request to your IPN URL (it is not part of the JSON body).

note

Validating this token ensures notifications originate from iPay and are untampered.

Obtain the token from your iPay account manager when your API key is issued. Store it securely. When receiving an HTTP POST callback, compare the authorization header to your stored token before processing the body.

info

Implementing the token check is optional but highly recommended. Without it, protect your IPN endpoint with measures like IP whitelisting.

Example Verification (Pseudo-code):

if request.headers.get('authorization') == stored_secret_token:
    process_payment(request.json)
else:
    reject_callback()