Checkout Verification Webhook — Payout Developers

Overview

The checkout.verification webhook is sent when a bank payment is matched to a checkout during statement reconciliation. It provides encrypted payer account details (name and IBAN) that you can use for identity verification.

This webhook is only triggered for bank-based payment methods (bank transfer, bank button, PISP).

Note

To enable this webhook, contact us to activate the webhook_verification feature on your account.

Webhook payload

JSON

{
    "external_id": "74775d02-745f-4198-cf3c-be9f1971dabe",
    "object": "webhook",
    "type": "checkout.verification",
    "data": {
        "object": "checkout",
        "id": 141209,
        "external_id": "74775d02-745f-4198-cf3c-be9f1971dabe",
        "amount": 300,
        "currency": "EUR",
        "redirect_url": "https://some-eshop.local/merchant_redirect_url",
        "customer": {
            "first_name": "John",
            "last_name": "Doe",
            "email": "john.doe@payout.one",
            "iban": null
        },
        "account_details": {
            "name": "<encrypted>",
            "iban": "<encrypted>"
        },
        "payment": {
            "object": "payment",
            "status": "successful",
            "payment_method": "bank_transfer",
            "failure_reason": "",
            "created_at": 1635412755,
            "fee": 8,
            "net": 292
        },
        "metadata": null,
        "status": "succeeded",
        "is_status_final": true
    },
    "nonce": "QjJqWEtiVDBNSmMyTm11dg",
    "signature": "f3b8264f42930eff215c6570f4bcdd50bcedcaf3c6da8ccfd301c6de41f36607"
}

The account_details.name and account_details.iban fields contain AES-256-CBC encrypted payer details from the bank statement. See Decrypting account details below.

Signature verification

Same as for other webhooks. Canonical string:

Code

external_id|type|nonce|client_secret

Hash with SHA256, encode Base16 lowercase.

Decrypting account details

Derive the key: lowercase(hex(SHA512(client_id)))[0..31]
Base64-decode the encrypted value
First 16 bytes = IV, rest = ciphertext
Decrypt with AES-256-CBC, remove PKCS7 padding