Your key, its calls and your webhook.

Set an https address in the console and every answer the 837P claims sandbox (POST /v1/sandbox/claims) makes, and every change to an enrollment request, is posted to it as an event, the moment it is made, signed with a secret only you and Payerworks hold. An event your server does not take is tried again, and every event is kept for 30 days, to list and to send again.

Each POST is signed under the Standard Webhooks specification, so any of its libraries checks it: webhook-id is the event’s id, webhook-timestamp the time it was signed in Unix seconds, and webhook-signature is v1, a comma and the signature in base64.

That signature is HMAC-SHA256 over the id, a period, the timestamp, a period and the raw body exactly as it arrived, keyed with your signing secret’s bytes: the part after whsec_, decoded from base64.

Each POST also carries the Payerworks-Signature header the first receivers were built on: t, the time it was signed in Unix seconds, and v1, HMAC-SHA256 keyed with your whole signing secret over the time, a period and the raw body, written in hex.

Check one of them before you trust the body: compute the same HMAC, compare the two in constant time, and refuse a time more than five minutes from your clock, so a captured event cannot be sent to you again.

The events, their signature and code to check it are on the Developers page.