Cryptographically Signed Webhooks & Events Engine
Stay synchronized with transaction lifecycles. Receive instant, tamper-proof event streams for payment authorizations, refunds, payouts, and BBPS utility bill acknowledgments.
Verify Webhook Authenticity
Every request includes an x-mspay-signature header. Compute the HMAC-SHA256 hash using your secret key and compare in constant time to prevent replay and forgery attacks.
const crypto = require("crypto");
function verifyWebhook(payload, signatureHeader, secret) {
const expectedSignature = crypto
.createHmac("sha256", secret)
.update(payload)
.digest("hex");
return crypto.timingSafeEqual(
Buffer.from(signatureHeader),
Buffer.from(expectedSignature)
);
}Standard Event Catalog
All events are broadcasted with ISO 8601 timestamps and unique event IDs.
Triggered when a customer completes 3DS/UPI authentication successfully.
Triggered when funds are officially captured and settlement is locked.
Triggered if an acquiring bank or customer account rejects the debit.
Dispatched when an instant or standard refund is settled to the customer.
Dispatched when vendor/payroll funds settle into the beneficiary bank account.
Dispatched when an official NPCI Bharat BillPay acknowledgment token is generated.
Got Questions? We Have Answers.
Find detailed answers about technical integration, settlement cycles, RBI tokenization, and our BBPS network.
Ready to Upgrade Your Payment Infrastructure?
Join hundreds of forward-thinking enterprises, digital marketplaces, and distributor networks powered by MSPay multi-bank technology.