Webhook Configuration

Receive verified async payment notifications.

HellOOpass pushes bill/order events to your backend via signed webhooks.

Register a webhook via API

POST/api/dube/international/registerwebhookconfig.php

Registers a webhook endpoint and signing secret for a project.

Base URL: https://helloomarket.com

Request headers

Header	Value	Required
`Content-Type`	`application/json`	Yes

Request body

Parameter	Type	Description
`project`	string	Project identifier to attach the endpoint to.
`url`	string	Public HTTPS endpoint that receives events.
`secret`	string	Signing secret used to verify event signatures.
`events`	string	Event names to subscribe to: `placed`, `confirmed`, `rejected`, `success`.
`operatorName`	string	Name of the operator configuring the endpoint.

Example request

curl -X POST https://helloomarket.com/api/dube/international/registerwebhookconfig.php \
  -H "Content-Type: application/json" \
  -d '{
    "project": "proj_1024",
    "url": "https://your-app.com/webhooks/helloopass",
    "secret": "YOUR_WEBHOOK_SIGNING_SECRET",
    "events": "placed,confirmed,rejected,success",
    "operatorName": "Integration Team"
  }'

Response contract

Response fields are not yet published — log the raw response and confirm the schema with your HellOOpass integration team.

Endpoint requirements

HTTPS: Public TLS endpoint required.
Fast 2xx: Respond quickly to acknowledge receipt.
Verify signatures: Validate the signature on every delivery against a stored signing secret.
Stable URL: Avoid changing paths in production.
Separate per env: Use distinct endpoints/secrets for sandbox and production.

Recommended handler flow

Receive and verify signature against raw body.

Enqueue event with ID for deduplication.

Return 200 OK immediately.

Process asynchronously with idempotent logic.

Common mistakes

Slow handlers: Do work after responding or via queue.
Parsed-body verification: Verify against raw bytes.
No idempotency: Retries can double-apply events.
Mixed environments: Never use sandbox secrets in production.
HTTP in prod: Only HTTPS is acceptable.