solidgate-webhooks

Solidgate Webhooks

When to Use This Skill

• How do I receive Solidgate webhooks?
• How do I verify Solidgate webhook signatures?
• How do I handle card_gate.order.updated or subscription.updated.v2 events?
• Why is my Solidgate webhook signature verification failing?
• Setting up a Solidgate payment or subscription webhook handler

Verification (core)

Solidgate does not use Standard Webhooks. Each request carries two headers:

• merchant — your webhook public key (prefix wh_pk_)
• signature — the HMAC to check

The signature is built with an unusual double-encode: HMAC-SHA512 over publicKey + rawBody + publicKey using your webhook secret key (wh_sk_), then take the hex digest, then Base64-encode that hex string (you encode the hex text, not the raw digest bytes). Use the exact raw request body — never re-serialize the JSON, or verification fails.

Node (matches @solidgate/node-sdk's internal signing):

const crypto = require('crypto');

function verifySolidgate(rawBody, signature, publicKey, secretKey) {
  const body = Buffer.isBuffer(rawBody) ? rawBody.toString('utf8') : rawBody;
  const hex = crypto.createHmac('sha512', secretKey)
    .update(publicKey + body + publicKey)   // publicKey wraps the raw body
    .digest('hex');                          // 1) hex digest
  const expected = Buffer.from(hex).toString('base64'); // 2) base64 of the hex string
  try {
    return crypto.timingSafeEqual(Buffer.from(signature), Buffer.from(expected));
  } catch {
    return false; // length mismatch = invalid
  }
}

Python (manual — the solidgate-sdk has no public webhook-verify helper):

import base64, hashlib, hmac

def verify_solidgate(raw_body: bytes, signature: str, public_key: str, secret_key: str) -> bool:
    message = public_key.encode() + raw_body + public_key.encode()
    hex_digest = hmac.new(secret_key.encode(), message, hashlib.sha512).hexdigest()
    expected = base64.b64encode(hex_digest.encode()).decode()
    return hmac.compare_digest(expected, signature)