Sub-Second Payment Webhooks: Architecture and Engineering Best Practices

Webhooks are the backbone of modern fintech integration. When an end-user pays via MFS or Bangla QR, your server must be notified with near-zero latency while maintaining cryptographic integrity against man-in-the-middle attacks.

1. Webhook Lifecycle in FuturePay

FuturePay follows a high-throughput reactive webhook architecture:

1. Ingestion: Android Daemon reads incoming SIM SMS via a local ContentObserver and posts it to FuturePay via SSL.
2. Matching Engine: SmsPaymentMatcher verifies amount, time window (30 minutes), and extracts the unique TrxID using regex patterns.
3. Dispatch: WebhookDispatchService issues an asynchronous HTTP POST with HMAC SHA256 signature headers to your webhook_url.

2. Verifying the Webhook Signature

Always verify the authenticity of webhook requests on your server before marking orders as paid:

$signature = $request->header('X-FuturePay-Signature');
$expected = hash_hmac('sha256', $request->getContent(), $brandSecretKey);

if (!hash_equals($signature, $expected)) {
    abort(401, 'Invalid Signature');
}