How Mollie payment webhooks and status updates work
The webhook says something changed, your backend fetches what.
- Answers
- Why does a Mollie webhook not include the payment status?
- Topics
- Amsterdam · design · iPad · lemmid-store · money · payments · programming · server · tablet · vim · work
- Full article on willem.com
- https://willem.com/en/2020-03-25_designing-and-implementing-a-micro-payment-system/
Summary
Mollie's webhook only tells my backend that something changed on a payment, never the new status itself. My server then requests the actual status over a secure channel using the secret API key and acts on the result.
Full text
The webhook delivers a message like: look, something changed on payment XYZ. It deliberately omits the new status, for security: if the status travelled in the webhook, malicious users might mimic the call. Instead the backend fetches the real status from the payment provider with its secret API key, then takes the appropriate action, such as sending email notifications or starting delivery of goods. Treat payment status as an asynchronous process. Users close the payment page or leave devices unattended, and banks have interruptions, so you never know precisely when a payment completes. Handle status updates separately from the primary user interaction. Also calculate the amount on the server, never in the client, because frontend code can be manipulated through the browser. I implemented this in NodeJS; Mollie also offers PHP, Ruby and Python packages.