LicenseChain

Pay merchant webhooks

Pay delivers payment lifecycle events to your HTTPS endpoint with x-lc-pay-* headers. This is separate from Core API app webhooks (X-Webhook-Signature) and Mirror redirect HMAC.

Core API webhook setup: Core API Webhooks. Multi-language signature verification samples: API examples (multi-language).

Event types

  • payment.confirmed โ€” deposit completed (primary success event sellers handle)
  • payment.pending โ€” payment still processing
  • payment.failed, payment.canceled โ€” failure / buyer cancel

Production Mirror sellers verify x-lc-pay-signature, accept payment.confirmed, then confirm with POST https://pay.licensechain.app/api/checkout/mirror/validate before marking the local order paid. See Pay Mirror API.

Merchant webhook delivery headers

  • x-lc-pay-signature โ€” HMAC-SHA256 signature
  • x-lc-pay-event-id โ€” unique event id
  • x-lc-pay-event-type โ€” event type
  • x-lc-pay-idempotency-key โ€” dedupe key
  • x-lc-pay-timestamp โ€” signed timestamp

Signature verification

Message format for signature validation:

{'{'}timestamp{'}'}.{'{'}rawJsonPayload{'}'}

Implementations in Node, Python, Go, PHP, and Ruby are in API examples (multi-language) (constant-time compare recommended).

Delivery behavior

  • Successful deliveries are acknowledged by your endpoint returning a 2xx response.
  • Failed deliveries are retried automatically; treat events as idempotent using x-lc-pay-idempotency-key.
  • Always verify x-lc-pay-signature before acting on an event.