Webhook Validation

If you wish to integrate PayPal webhooks with your website, you will need to manage your webhooks via code or via the PayPal developer portal.

NOTE

The PayPal Node SDK currently does not support certificate chain validation, so it is necessary to validate the incoming webhook event data by retrieving the event data directly from PayPal.

Steps

1. Create at least one webhook by either following the create webhook sample; or you can select your application in the developer portal, select the Sandbox or Live environment, and click the Add Webhook button.
2. Make sure to select at least one event type. For testing, try selecting all of them.
3. In your Node application, when handling an incoming webhook event, you should parse the incoming event data for the id value and then issue a HTTP GET for the event data from the PayPal servers. For example:

var paypal = require('paypal-rest-sdk');

function(request, response) {
  try {
    // Get the Webhook event id from the incoming event request
    var webhookEventId = JSON.parse(request.body).id;

    paypal.notification.webhookEvent.get(webhookEventId, function (error, webhookEvent) {
        if (error) {
            console.log(error);
            // The webhook event data could not be found.
            // Send a HTTP 503 response status code ( http://www.w3.org/Protocols/rfc2616/rfc2616-sec10.html#sec10.5.4 )
            // to signal to PayPal to resend the request at a later time.
            response.sendStatus(503);
        } else {
            // Proceed to use the data from PayPal
            console.log("Get webhookEvent Response");
            console.log(JSON.stringify(webhookEvent));
            response.sendStatus(200);
        }
    });
  } catch (e) {
    // The webhook id could not be found or any other error occurred.
    // Send a HTTP 503 response status code ( http://www.w3.org/Protocols/rfc2616/rfc2616-sec10.html#sec10.5.4 )
    // to signal to PayPal to resend the request at a later time
    response.sendStatus(503);
  }
}

Note

The HTTP 503 response status code is sent to inform a valid PayPal request to try again at a later time. See the Webhooks overview documentation to understand what an Event Response can be.