Webhooks

Webhooks are crucial for a successful integration with Adyen, and the only way you'll receive automatic updates about:

• Events that are not triggered by a request from your side, for example when a shopper initiated a chargeback, or when a new report becomes available.
• Requests that are processed asynchronously. For example, for many local payment methods such as iDEAL, the outcome of a payment request might take several hours to confirm. After we know whether the payment was successful, we send you a webhook event to inform you of this.

You can use webhooks to automate business processes, for example order management or downloading reports for accounting.

To manage webhooks, you must have the following user role:

• Merchant technical integrator

To process webhooks, you need to:

1. Expose an endpoint on your server.
2. Set up webhooks in your Customer Area.
3. Accept webhook events.

Step 1: Expose an endpoint on your server

Webhooks are HTTP callbacks sent to an endpoint on your server. Adyen requires you to use HTTPS endpoints with TLSv1.2 or TLSv1.3.

To receive webhook events, you need a server that has:

• An endpoint that can receive a JSON or a SOAP call, or an HTTP POST.
• For test environments: an open TCP port for HTTP traffic (80, 8080, or 8888) or HTTPS traffic (443, 8443, or 8843) with TLSv1.2 or TLSv1.3.
• For live environments: an open TCP port for HTTPS traffic (443, 8443, or 8843) with TLSv1.2 or TLSv1.3.
• A username and password for basic authentication.
  You need to enter these in your Customer Area in Step 3.

Depending on your network and security requirements, you might also need to add our network to your firewall's allowlist.

Step 2: Accept webhooks

To deliver a webhook to your server, we require you to acknowledge every webhook event with a response containing the string: [accepted].

When we deliver a webhook event to your server:

1. Verify the HMAC signature included in the webhook event payload.
   This is to confirm that the webhook event was sent by Adyen, and was not modified during transmission. For more information, refer to Verify HMAC signatures. If the HMAC signature is not valid, we do not recommend acknowledging the webhook event.
2. Store the webhook event in your database.
3. Acknowledge the webhook event with HTTP 200 and [accepted] in the response body.
4. Apply your business logic.
   Make sure that you acknowledge the webhook event before applying any business logic, because a breakage in your business logic could otherwise prevent important updates from reaching your system.

For information about the structure and content of webhooks, refer to Webhook structure and types.

Step 3: Set up webhooks in your Customer Area

Enter your server's details, and select additional information that you want to receive through webhooks. You can configure webhooks either at company or merchant account level. At the company account level, you can configure webhooks for a group of merchant accounts, or for all merchant accounts.

1. Log in to your Customer Area. To configure webhooks for a merchant account, switch to that merchant account.
2. Select Developers > Webhooks.
3. Select + Webhook.
4. Under Recommended webhooks > Standard webhook select Add.
5. Select the Enabled toggle.
6. Select the edit icon for Server configuration.
7. In the following fields, enter the corresponding information:
   • URL: your webhook server's URL. It must be a public URL.
   • Method: JSON, HTTP Post, or SOAP.
   • Encryption Protocol: TLSv1.2 or TLSv1.3
8. Select Apply.
9. To configure webhooks for specific merchant accounts from a company account, select the edit icon for Merchant accounts and include or exclude accounts. Select Apply.
10. Under Security > Basic authentication, select the edit icon . Enter your server's username and password. Select Apply.
11. Under Security > HMAC Key, select the edit icon . Select Generate. Copy the HMAC Key using the copy icon and store it safely in your system. Select Apply.
12. Optionally configure additional settings].
13. Select Save changes.

Step 4: Test and go live

Test your webhooks server

Your server must acknowledge webhooks with a response message.

1. Log in to your Customer Area.
2. Select Developers > Webhooks.
3. Select the edit icon for the webhook to test. You can test only the event codes you configured for this webhook.
4. Select Test configuration.
5. If you're on a company account, select a Merchant account from the dropdown list.
6. In the Event dropdown list, select the event code to test webhooks for.

If the test webhook failed, you get an error message with the reason. Troubleshoot the problem.

End-to-end testing

We recommend you create a test payment and test the webhooks associated with it. Match the test payment to a webhook with the pspReference or merchantReference in the payload of the webhook.

Go live

1. Follow the instructions in Step 2 to set up webhooks in your live Customer Area.
2. Test webhooks in your live Customer Area.
3. If you're verifying HMAC signatures, make sure that you use the HMAC key from your live Customer Area, which is different from the HMAC key from your test Customer Area.