PayPal Webhook Verification Java SDK

Question

I am currently integrating the "PayPal Smart Payment Buttons" into a WebApp. Passing custom fields and receiving a Webhook / Purchase Confirmation with this data works quite fine.

I am having trouble with validating a received Webhook. The Documentation is poor and leads mit either to v1 (deprecated) or to v2 Java SDK where nothing is mentioned about Webhook verification.

I integrated the following SDK in Java.

<dependency>
            <groupId>com.paypal.sdk</groupId>
            <artifactId>checkout-sdk</artifactId>
            <version>1.0.2</version>
        </dependency>

But I am not able to find a way to verify a Webhook. Did I read over something or how can I achieve the Webhook verification?

score 1 · Accepted Answer · answered Jun 01 '20 at 11:51

There is no supported SDK for webhook integration

(The references to old SDKs on this page: https://developer.paypal.com/docs/integration/direct/webhooks/rest-webhooks/#verify-event-notifications are out of date)

So, you have some choices.

DIY verification, using the information in the event headers: https://developer.paypal.com/docs/integration/direct/webhooks/notification-messages/#event-headers
Direct integration with the HTTPS APIs: https://developer.paypal.com/docs/api/webhooks/v1/#verify-webhook-signature
Don't use webhooks, at all, for anything, and instead switch your integration to a server side implementation that does not need webhooks.

The last option is actually what I would recommend.

Here is the server-side SDK you need: https://github.com/paypal/Checkout-Java-SDK

With that you would implement two routes, one for "Set Up Transaction" (create order), and one for "Capture Transaction" (capture the order). There is a guide for these steps here: https://developer.paypal.com/docs/checkout/reference/server-integration/

The web front-end that will then connect to those two server-side routes is: https://developer.paypal.com/demo/checkout/#/pattern/server

There is no need for webhooks when using this server-side integration; you have an immediate response of success or failure when doing the capture on the server.

Thank you for your answer. I guess I‘ll switch to a server side implementation. — Markus G., Jun 01 '20 at 13:21

Osiris Team · Answer 2 · 2022-09-08T09:50:19.540

Had exactly the same issue as you, thats why I created my own API for handling that: https://github.com/Osiris-Team/PayHook

It's using the official PayPal-Rest API for validation, here is an example:

MyPayPal paypal = new MyPayPal(clientId, clientSecret, MyPayPal.Mode.SANDBOX);
PaypalWebhookEvent event = new PaypalWebhookEvent(paypalWebhookId, paypalWebhookEventTypes, header, body);
if(!paypal.isWebhookEventValid(event)){
    System.err.println("Received invalid PayPal webhook event.");
    return;
}

Besides validating webhook events it also provides other useful methods for interacting with the PayPal REST API that are not available in the official Java-SDK.

Hope I could help, have a nice day!

PayPal Webhook Verification Java SDK

2 Answers2

Linked