Verify Payment
Validate the checkout result and confirm payment status before fulfilment.
Verify before fulfilment
The success callback is a customer-experience signal, not sufficient proof of payment. Forward its result to your backend and verify it before updating business state.
Never verify with a Salt Key in the browser.
A client-side secret can be extracted and used to forge results.
Verification flow
Receive the result
Send payment_id, order_id, and signature from Checkout to your backend.
Load your order
Read the expected order ID and amount from your database, not from browser input.
Verify signature
Generate the expected HMAC SHA-512 value with your Salt Key and compare it safely.
Confirm status
Use the authoritative server-side payment status before marking the order paid.
Security rules
- Build the signed value using the expected order ID stored by your server.
- Compare signatures in constant time and reject malformed values.
- Verify that payment amount and currency match the original order.
- Make fulfilment idempotent so callbacks and webhooks cannot fulfil twice.
- Treat pending, failed, expired, and cancelled states as unpaid.