PHP REST API webhook verification not successful, PHP SDK no longer in development
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
As there is currently no official SDK provided provided (which isn't out of date) I decided to integrate the REST API myself.
So far so good. I can create orders and receive webhooks if something happens on the paypal side of things.
However I ran into problems verifying the webhook server side.
There is a documentation which explains it here:
https://developer.paypal.com/api/rest/webhooks/
I set together the string which is mentioned there co...
<transmissionId>|<timeStamp>|<webhookId>|<crc32>
And to verify this I wrote the following code using the openssl_verify() method:
I have spent at least 3-4 days debugging and researching this issue. Does anybody have an idea what I am missing here?
<?php
$payload = file_get_contents('php://input');
$transmission_id = $_SERVER['HTTP_PAYPAL_TRANSMISSION_ID'];
$transmission_sig = $_SERVER['HTTP_PAYPAL_TRANSMISSION_SIG'];
$transmission_time = $_SERVER['HTTP_PAYPAL_TRANSMISSION_TIME'];
$cert_url = $_SERVER['HTTP_PAYPAL_CERT_URL'];
$cert = file_get_contents($cert_url);
$signature = base64_decode($transmission_sig);
// <transmissionId>|<timeStamp>|<webhookId>|<crc32>
$string_chain = implode('|', [
$transmission_id,
$transmission_time,
'mywebhookid',
crc32($payload),
]);
$success = openssl_verify(
data: $string_chain,
signature: $signature,
public_key: $cert,
algorithm: 'sha256WithRSAEncryption'
);
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hey, it looks like you were very close.
This is how i solved that problem:
$success = (
openssl_verify(
data: implode(separator: '|', array: [
$httpPayPalTransmissionId,
$httpPayPalTransmissionTime,
$webhookID,
crc32(string: $rawRequestBody),
]),
signature: base64_decode(string: $httpPayPalTransmissionSignature),
public_key: openssl_pkey_get_public(public_key: file_get_contents(filename: $httpPayPalCertUrl)),
algorithm: 'sha256WithRSAEncryption'
) === 1
);
![](/skins/images/7E5164EB81F8D9C49ECAF3E2A7A26B2B/responsive_peak/images/icon_anonymous_message.png)
Haven't Found your Answer?
It happens. Hit the "Login to Ask the community" button to create a question for the PayPal community.
- Assistance Required: Locating Existing APP ID for Adaptive Payments in PayPal Business Account in NVP/SOAP APIs
- Live Payment Development: Successful and then Returned. [PAYMENT_DENIED] in PayPal Payments Standard
- IPN SHOWS NO HTTP RESPONSE - LISTENER WORKS WITH LOCAL FORM POST in Sandbox Environment
- Why am I not seeing HTTP responses for IPN? in Sandbox Environment
- After 3DS2 OTP verification page, Is payment completed or what, how to fetch response in REST APIs