tikkie-webhooks

Tikkie Webhooks

Tikkie is ABN AMRO's payment-request product. This skill covers notification subscriptions in the Tikkie API v2 (2.3.x):

• Production: https://api.abnamro.com/v2/tikkie
• Sandbox: https://api-sandbox.abnamro.com/v2/tikkie

Every API call carries an API-Key header (the consumer key from your ABN AMRO developer portal app) and an X-App-Token header (a UUID app token from the Tikkie Business Portal).

This skill does not cover ABN AMRO's separate Business Account Notification API (bank-account transaction webhooks) or the retired Tikkie v1 API. Their schemes differ, so don't mix them.

When to Use This Skill

• How do I receive Tikkie payment notifications?
• How do I verify a Tikkie webhook signature? (You can't, because Tikkie doesn't sign them.)
• How do I subscribe to Tikkie notifications (/paymentrequestssubscription, /transactionssubscription)?
• How do I handle PAYMENT, REFUND and BUNDLE notifications?
• Why doesn't the Tikkie notification include the amount or status?

Verification (core): there is no signature

The official OpenAPI spec (TikkieAPI_v2.3.yaml) defines only a JSON request body and a 2XX acknowledgement for notification callbacks. It defines no signature header, shared secret, HMAC, timestamp header or asymmetric signature, and ABN AMRO publishes no source-IP allowlist. Do not write an HMAC verifier for Tikkie. You'd have to invent the inputs, because Tikkie sends none.

Use these mitigations instead. They reduce risk, but they don't prove who sent the request:

// 1. Weak check: subscriptionId must equal the id returned (201) when you subscribed.
const allowed = process.env.TIKKIE_SUBSCRIPTION_ID.split(',').map((s) => s.trim());
if (!allowed.includes(body.subscriptionId)) return res.status(403).end();

// 2. Strong check: the notification only carries tokens. Re-fetch the real record.
const path = {
  PAYMENT: `/paymentrequests/${body.paymentRequestToken}/payments/${body.paymentToken}`,
  REFUND:  `/paymentrequests/${body.paymentRequestToken}/payments/${body.paymentToken}/refunds/${body.refundToken}`,
  BUNDLE:  `/transactionbundles/${body.bundleId}`,
}[body.notificationType];
const r = await fetch(`${process.env.TIKKIE_API_BASE_URL}${path}`, {
  headers: { 'API-Key': process.env.TIKKIE_API_KEY, 'X-App-Token': process.env.TIKKIE_APP_TOKEN },
});
if (r.status === 404) return res.status(403).end(); // made-up tokens → forged
const record = await r.json(); // amountInCents, status, … come from HERE, never the notification