square-webhooks

Square Webhooks

When to Use This Skill

• How do I receive Square webhooks?
• How do I verify Square webhook signatures?
• How do I handle payment.updated or refund.created events?
• Why is my Square webhook signature verification failing?
• Setting up Square webhook handlers for payments, refunds, invoices, or orders

Verification (core)

Square signs each webhook with an HMAC-SHA256 over the notification URL concatenated with the raw request body (notificationUrl + rawBody, in that order — confirmed by testing), base64-encoded, delivered in the x-square-hmacsha256-signature header. The notification URL is part of the signed content, so it must exactly match — byte-for-byte — the URL configured in your Square subscription. Always verify the raw body — never JSON.parse first.

Top pitfall: the HMAC key is the subscription's Signature Key (short, e.g. qfjakbt2uWB8DKAMECF-EA), used verbatim — not an OAuth access token (EAAA…), which produces no match. Square also still sends a deprecated x-square-signature (HMAC-SHA1) header alongside the SHA-256 one; verify the SHA-256 header.

Node (official Square SDK — recommended):

const { WebhooksHelper } = require('square');

// requestBody is the raw HTTP body string; notificationUrl must match Square exactly
const isValid = await WebhooksHelper.verifySignature({
  requestBody: rawBody,
  signatureHeader: req.headers['x-square-hmacsha256-signature'],
  signatureKey: process.env.SQUARE_WEBHOOK_SIGNATURE_KEY,
  notificationUrl: process.env.SQUARE_WEBHOOK_URL,
});
if (!isValid) return res.status(400).send('Invalid signature');

Python (manual — mirrors what the SDK does, timing-safe):

import hmac, hashlib, base64

def is_valid(raw_body: bytes, signature: str, key: str, url: str) -> bool:
    payload = url.encode() + raw_body            # notification URL + raw body
    digest = hmac.new(key.encode(), payload, hashlib.sha256).digest()
    expected = base64.b64encode(digest).decode()
    return hmac.compare_digest(expected, signature)