Webhooks

Provider callbacks let Stripe, Square, and Dwolla notify Payflow when payment or transfer status changes after your client API call returns.

These callback URLs are configured in provider dashboards or Payflow-managed provider readiness settings. Your application does not call them directly, and they do not use Payflow client API keys.

Implemented callback sources

Successful provider callback handling returns:

{
  "received": true
}

This response intentionally does not use the Payflow client API envelope because providers expect simple acknowledgement payloads.

Stripe behavior

Payflow verifies Stripe callback signatures before applying mapped payment updates. If the signature is missing or invalid, Payflow returns 400.

Square behavior

Payflow verifies Square callback signatures before applying mapped payment updates. If the signature or payload is invalid, Payflow returns 400.

Dwolla behavior

Dwolla events are parsed and mapped to ACH transfer updates where possible. Environment selection is handled as part of provider callback configuration.

Callback safety

Follow these rules for all provider callbacks:

• Keep provider callback secrets out of source control.
• Use HTTPS in non-local environments.
• Configure callbacks for the hosted Payflow API origin, https://api.ftosllc.co, and the matching provider environment.
• Make provider retries safe. Payflow applies idempotent updates where transaction references allow it.
• Do not assume every provider event changes a Payflow transaction.
• Monitor non-2xx provider callback delivery in provider dashboards.

What to store

Store Payflow and provider identifiers on your own payment record:

• payflowReference
• Provider returned by Payflow
• Provider payment or transfer reference when available
• Your order, invoice, transfer, or cart ID
• Last known status
• Last callback timestamp if your own system mirrors status changes