Every event we deliver is a signed POST. Grab a throwaway endpoint below, fire a sample event, and watch it arrive — with the M360-Signature verified against your secret. Try the tampered button to see verification reject a forged event.
// Verify an incoming webhook (Node):
import crypto from "crypto";
function verify(secret, header, rawBody) {
const [, t, v1] = header.match(/t=(\d+),v1=([a-f0-9]+)/);
const expected = crypto.createHmac("sha256", secret)
.update(t + "." + rawBody)
.digest("hex");
return crypto.timingSafeEqual(Buffer.from(expected), Buffer.from(v1));
}
// header = req.headers["m360-signature"]
// rawBody = the exact bytes you received (do not re-serialize)Register a real endpoint via the Webhooks docs. See every tool on the examples page.
© 1998–2026 Electronic Payments, Inc. Test mode.