{
    "code": "00000000",
    "message": "Success",
    "traceId": "85776c0dc17b4911bc38f6c24bf98504",
    "merchantId": "851244000040",
    "notifyTime": "2026-06-16T18:14:28.26137491+08:00",
    "notifyType": "PAYMENT",
    "data": {
        "merchantOrderId": "ORD1781604849792920",
        "orderId": "1937771703079430",
        "totalAmount": "10.01",
        "currency": "HKD",
        "country": "HK",
        "status": "SUCCESS",
        "completeTime": "2026-06-16T18:14:28.177+08:00",
        "paymentDetails": {
            "paymentMethodType": "WALLET",
            "targetOrg": "ALIPAYHK"
        },
        "reference": "goods reference",
        "cashierCountry": "HK"
    }
}

{
  "code": "00000000",
  "message": "Success"
}

import org.apache.commons.codec.digest.HmacAlgorithms;
import org.apache.commons.codec.digest.HmacUtils;
import org.springframework.stereotype.Controller;
import org.springframework.web.bind.annotation.PostMapping;
import org.springframework.web.bind.annotation.RequestBody;
import org.springframework.web.bind.annotation.ResponseBody;

import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;

@Controller
public class WebhookExampleController {

  @PostMapping("/webhook/example")
  @ResponseBody
  public String receive(HttpServletRequest request, @RequestBody String payload, HttpServletResponse response) {
    String responseBody = "";

    StringBuilder valueToDigest = new StringBuilder();
    String timestamp = request.getHeader("x-timestamp");
    valueToDigest.append(timestamp);
    valueToDigest.append(payload);

    String signature = request.getHeader("x-signature");
    String secret = getSecret();

    HmacUtils hmacUtils = new HmacUtils(HmacAlgorithms.HMAC_SHA_256, secret);
    if (hmacUtils.hmacHex(valueToDigest.toString()).equals(signature)) {
      // Do something with event
      response.setStatus(HttpServletResponse.SC_OK);
    } else {
      response.setStatus(HttpServletResponse.SC_BAD_REQUEST);
      responseBody = "failed to verify the signature";
    }

    return responseBody;
  }
}

<?php
use RingCentral\Psr7\Response;

function getSecret() {
  return 'your_webhook_secret';
}

function handler($request, $context): Response {
  $timestamp = $request->getHeaderLine('x-timestamp');
  $body = $request->getBody()->getContents();

  $secret = getSecret();
  $signature = $request->getHeaderLine('x-signature');

  if (hash_hmac('sha256', $timestamp . $body, $secret) != $signature) {
    return new Response(400, array(), 'failed to verify the signature');
  }

  // Do something with event
  return new Response(200, array(), $body);
}

// Koa
const crypto = require('crypto');

const secret = '<CLIENT_API_WEBHOOK_SECRET>';

async function webhookController(ctx, next) {
  const { headers } = ctx.request;
  // Use raw body string (e.g. ctx.request.rawBody from middleware); do not use a parsed object.
  const rawBody = ctx.request.rawBody ?? (typeof ctx.request.body === 'string' ? ctx.request.body : JSON.stringify(ctx.request.body));
  const ts = headers['x-timestamp'];
  const valueToDigest = `${ts}${rawBody}`;
  const signatureHex = crypto.createHmac('sha256', secret).update(valueToDigest).digest('hex');

  if (signatureHex === headers['x-signature']) {
    // Do business logic after signature is verified
    return next(); // HTTP response code 200: acknowledge the webhook
  } else {
    ctx.status = 400;
    ctx.body = 'failed to verify webhook signature';
    return;
  }
}