Processing callbacks
Set up an HTTPS webhook endpoint where CryptoProcessing can send callbacks. Your webhook URL must use HTTPS, use a domain name, and be considered safe by VirusTotal and similar scanners. After you create the endpoint, register it in CryptoProcessing — see Set up callback URL. When CryptoProcessing sends a callback to your endpoint, your system should:1
Validate the callback
Generate an HMAC-SHA512 signature for the callback request body using your secret key, then compare it with the value in the
X-Processing-Signature header.2
Process the event
Check whether the callback is a duplicate by verifying that its transaction ID has not already been processed. If it has not, process the event, for example by updating the customer’s balance in your system.
3
Return HTTP 200 OK
No response body is required.
For additional security, you can whitelist the CryptoProcessing IP addresses used for callback delivery. Contact Support for the current list of IP addresses.
Retry schedule
If your system does not respond with HTTP 200 OK to a callback, CryptoProcessing keeps the callback in the sending queue and retries delivery 12 times after the initial attempt. Each retry is scheduled relative to the previous attempt: +1 minute, then +5, +15, +30, +60, +90, +120, +180, +240, +240, +240, +240 minutes. The retry schedule is not configurable.Avoiding duplicate processing
The system may resend callbacks in certain cases, so your integration should be able to recognize and ignore duplicates:- If you receive a callback with
status: "not_confirmed", ignore any repeated callback with the same status and the sameTXID. - If you receive a callback with
status: "confirmed", apply the same logic to avoid processing it twice.
201 to stop further retries. Otherwise, CryptoProcessing continues to expect an HTTP 200 response and keeps resending the callback.