Verify webhooks

In Dashboard → Webhooks, add a public HTTPS endpoint for test or live mode and store its signing secret in server-side secret storage. Lynq sends:

Header	Use
`Lynq-Event-Id`	Deduplicate deliveries.
`Lynq-Signature`	Verify the HMAC signature.

The signature is HMAC-SHA256(<timestamp>.<raw request body>), using the endpoint signing secret. The header format is t=<unix timestamp>,v1=<signature>.

import { createHmac, timingSafeEqual } from "node:crypto";

function verify(rawBody: string, timestamp: string, received: string, secret: string) {
  const expected = createHmac("sha256", secret)
    .update(`${timestamp}.${rawBody}`)
    .digest("hex");
  const a = Buffer.from(received, "hex");
  const b = Buffer.from(expected, "hex");
  return a.length === b.length && timingSafeEqual(a, b);
}

Verify the raw request body before parsing JSON. Store processed event IDs, then fulfil an order only from a verified payment_intent.succeeded event. Temporary network failures, 408, 429, and 5xx responses are retried with exponential backoff and jitter for up to 72 hours. Return 2xx after processing; other 4xx responses are not retried.

Last modified on August 7, 2026

Start here

Payment methods

Build your integration

Test and go live

Reference

Resources

Verify webhooks

Verify webhooks

​Verify webhooks

Verify webhooks