Set up webhooks

Webhooks are notifications about events occurring in the system. When a specific event occurs, Xsolla sends an HTTP request, in which event data is transmitted, to your application. This is usually a POST request in JSON format.

Event examples:

• user interaction with an item catalog
• payment or cancellation of an order

List of webhooks

For selling game keys, user validation and crediting of items are not required. You can connect webhooks if you want to receive information about events, such as payment or order cancellation.

If you connect webhooks, it is important to process all incoming required webhooks.

To switch to the new option with receiving combined webhooks, contact your Customer Success Managers or email to csm@xsolla.com.

For the full operation of the in-game store and payment management, it is necessary to implement the processing of the main webhooks:

If item catalog personalization is implemented on your application’s side, set up processing of Catalog personalization on the partner’s side.

Set up webhooks in Publisher Account

To enable receiving webhooks:

1. Open your project in Publisher Account.
2. Click Project settings in the side menu and go to the Webhooks tab.
3. In the Webhook server field, specify the URL of your server where you want to receive webhooks in the https://example.com format. You can also specify the URL you find in a tool for testing webhooks.

4. A secret key to sign project webhooks is generated by default. If you want to generate a new secret key, click the refresh icon.
5. Click Enable webhooks.

When you save the URL in the Webhook server field, you can see the Advanced settings section where you can give permissions to receive detailed information in webhooks. To do that, set the respective toggles to On. In the line of each permission, you can see the list of webhooks affected by the settings.

To disable receiving webhooks:

1. Open your project in Publisher Account.
2. Click Project settings in the side menu and go to the Webhooks tab.
3. Click Disable webhooks.

Test webhooks in Publisher Account

If webhooks are set up successfully, a webhook testing block is displayed below the webhook setup block.

The testing section in the Publisher Account varies depending on the webhook receiving option.

The process of testing for the scenario with combined webhooks is described below. In the Payments and Store tab, you can test the following webhooks:

• User validation (user_validation)
• Successful payment for order (order_paid)
• Order cancellation (order_canceled)

To test:

1. In the webhooks testing section, go to the Payments and Store tab.
2. In the drop-down menu, select Game keys. If the game key packages are not set up in Publisher Account, one the following buttons are displayed:
   • Connect – if the Game keys module is not connected
   • Configure – if you connected the module previously, but have not completed the setup
3. Fill in the necessary fields:
   1. Enter any value in the Xsolla Order ID field.
   2. Select the game keys package from the drop-down list.
   3. Specify game publishing platforms.
   4. User ID — when testing, you can use any combination of letters and digits.
   5. Public user ID — ID known to a user, e.g., an email or a nickname. This field is displayed if public user ID is enabled in your project in the Pay Station > Settings section.
   6. Xsolla Invoice ID — transaction ID on Xsolla side. When testing, you can use any numeric value.
   7. Invoice ID — transaction ID on your game’s side. When testing, you can use any combination of letters and digits. It is not a required parameter for a successful payment, but you can pass it to link the transaction ID on your side to the transaction ID on Xsolla side.
   8. Amount — payment amount. When testing, you can use any numeric value.
   9. Currency — select a currency from the drop-down list.
4. Click Test webhook.

User validation, Successful payment for order and Order cancellation webhooks with the specified data are sent to the provided URL. The results of testing each webhook type are displayed below the Test buttons. If public user ID is enabled in your project, you will also see the results of a user search check.

For each webhook, you need to configure processing both scenarios: a successful one and the one with an error.

Webhook listener

Webhook listener is program code that allows receiving incoming webhooks at a specified URL address, generating a signature, and sending a response to the Xsolla webhook server.

Generation of signature

When receiving a webhook, you should ensure the security of data transmission. To achieve this, a signature must be generated from the webhook data and verified that it matches the signature sent in the HTTP request header.

To generate a signature:

1. Concatenate the JSON from the request body and the project’s secret key.
2. Apply the SHA-1 cryptographic hash function to the string obtained in the first step.

Sending responses to webhook

To confirm receipt of the webhook, your server must return:

• 200, 201, or 204 HTTP code in case of a successful response.
• 400 HTTP-code with description of the problem if the specified user was not found or an invalid signature was passed.

Your webhook handler may also return a 5xx code in case of temporary issues on your server.

If the Xsolla server doesn’t receive a response to the Successful payment for order and Order cancellation webhooks or receives a response with a 5xx code, the webhooks are resent according to the following schedule:

• 2 attempts with a 5-minute interval
• 7 attempts with a 15-minute interval
• 10 attempts with a 60-minute interval

Maximum of 20 attempts to send webhooks are made within 12 hours from the first attempt.

If the Xsolla server doesn’t receive a response to Payment webhook or Refund webhook, or receives a response with a 5xx code, webhooks are also resent with an increased time interval. A maximum of 12 attempts are made within 12 hours.

If the Xsolla server doesn’t receive a response to the User validation webhook or receives a response with a code of 400 or 5xx, the User validation webhook is not resent.

In this case, an error is shown to the user and the Payment and Successful payment for order webhooks are not sent.

Last updated: January 23, 2025