Compare webhook delivery policies
Keep Sign-Up and gateway verification, retry timing and recovery separate.
Sign-Up subscriptions
Register a callback URL and keep the subscription secret on your receiver. Verify Signature as HMAC-SHA256 of the raw event JSON, without a nonce prefix. Applications and merchant status notifications use this contract. Retry condition Documented behavior HTTP failures 4xx and 5xx except 410 Gone Timeouts 10-second request timeout; 5-second connection timeout Retry delays 10 seconds, then 100 seconds, then 1000 seconds Delivery window Approximately 18 minutes The source lists an initial attempt plus three retries, but its final-failure sentence says three failed attempts. Do not turn that inconsistent count into an application guarantee.
Gateway notifications
Configure an HTTPS receiver with valid TLS under Merchant Portal Settings → Webhooks. Delivery starts after saving. Verify Webhook-Signature using the gateway signing key and nonce + "." + raw body. Return HTTP 200 after durable acceptance. Approximate retry phase Attempts 15 seconds after initial attempt 1 Every 60 seconds 3 5 minutes later 1 15 minutes later 1 30 minutes later 1 Every hour 10 Every 12 hours 2 24 hours later 1 The source describes up to 20 reattempts over about three days. Timing can change and backlog can reduce attempts; this is not a delivery SLA.
Network controls and recovery
The reviewed gateway source lists source ranges 104.192.32.81–104.192.32.87 and 104.192.36.81–104.192.36.87. Verify current ranges before deploying an allowlist. An allowlist does not replace signature validation. Monitor permanent failures and reconcile missed business state after an outage. Gateway receiver design Sign-Up verification